DisclosureLens
ILLINOISHackingHealthcareHealthcareCustomer Data InvolvedPIIPHIIdentity (basic)Government IDHealth (basic)CriticalResolved

Community First Medical Center

bd_6fa159828caaaaa5 · schema v1 · pii pii-v1

Severity

Critical

Discovered

—

Filed

Sep 26, 2023

To disclose

—

Affected

216,047

Linked

7 filings

Confidence

88%
Full breach record for Community First Medical Center →3 incidents on file

Community First Medical Center (IL healthcare provider) reported a hacking/IT incident involving a network server that affected the PHI of 216,047 individuals. Compromised data included names, addresses, telephone numbers, email addresses, Social Security numbers, medical record numbers, and health insurance information. The entity notified HHS, affected individuals, and the media, provided substitute notice and complimentary credit monitoring, implemented additional safeguards, and received OCR technical assistance regarding the HIPAA Rules.

HIPAA clock✓ HHS notified
⚠ no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.
⚠ No discovery dateThe OCR public portal omits the discovery date, so the 60-day notification clock cannot be evaluated from this source — only that the filing was submitted.

Incident timeline — partial

? — ?

Breach window unknown

Sep 26, 2023

Filed

—

Corroborated · see linked filings

Compliance clocks stay unassessable until a regulatory filing lands. Dashed segments fill in automatically when corroboration arrives.

This filing is one of 7 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

Show 2 more filings ↓up to 8d gap

Filing propagation · 7 filings · 7 states

View merged incident ↗
Indiana State AGSep 26 · first
Maine State AGSep 26 · first
Vermont State AGSep 26 · first
HHS OCRSep 26 · first · this page
Montana State AG+2d
Massachusetts State AG+6d
New Hampshire State AG+8d

Pattern: first filing Sep 26 (IN), last Oct 4 (NH) — a 8-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.