Social EngineeringHealthcareHealthcarePhishingData ExfiltratedData PublishedCustomer Data InvolvedGovernment IDIdentity (basic)Health (basic)MediumContained

Heart South Cardiovascular Group

bd_718fd6945d5f1904 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 11, 2025

Filed

Apr 13, 2026

To disclose

22 weeks

Affected

2state residents only

Linked

5 filings

Confidence

67%

Full breach record for Heart South Cardiovascular Group →4 incidents on file

Heart South Cardiovascular Group notified the New Hampshire Attorney General of a cybersecurity incident affecting approximately 2 NH residents. On November 11, 2025, the group learned an unauthorized party claimed to possess data. Investigation found no unauthorized network access, but a bad actor posted limited data on the dark web. Patient PII (names, SSNs, DOB) and PHI (treatments, diagnoses) were potentially exposed. Notifications began April 6, 2026, offering credit monitoring via Kroll.

J jump to incidentP pin to compareR raw source

Leak gap clock⏱ Leak >90d22 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

discovery → filing · 22 weeks / 153 days

Nov 11, 2025

Discovered

Apr 13, 2026

Filed

vs. sector median

+10 wks slower

This filing is one of 5 about the same incident.View merged incident

A leak claim by rhysida about this victim predates this filing by 153 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Siterhysidabd_2028c3f5990168862025-11-10 · +153dVerified by operator

Regulatory filings (3) · sorted by filing gap

HHS OCRbd_75ff5c082c82aced2026-04-06 · +7dVerified
Nebraska State AGbd_c12dc0d5f533ec4e2026-04-06 · +7dVerified by operator
Maine State AGbd_dc4e83aef803c8912026-04-06 · +7dVerified

Name: MCDONALD HOPKINS LLC
norm: mcdonald hopkins

Name: Heart South Cardiovascular Group
norm: heart south cardiovascular
Domain: heartsouthpc.com
Industry: Healthcarellm

Discovered: Nov 11, 2025
Materiality determined: —
Notification sent: Apr 6, 2026
Affected individuals: 2state-resident count only
Data types: Government IDIdentity (basic)Health (basic)
Data elements: Date of birthMedical information
Attack vector: Unknown
MITRE ATT&CK: T1566 PhishingT1078 Valid Accounts
Threat actor: External
Regulator citations: Notified New Hampshire Attorney General
Initial access: phishing_link

During the incident: Commenced a prompt and thorough forensic investigation with external cybersecurity professionals
Discovered that the bad actor recently posted a limited amount of Heart South data on the dark web
Providing the affected residents with written notification
Offering the affected residents whose Social Security numbers were impacted complimentary memberships with a credit monitoring service
Changes made: Secured the services of Kroll to provide identity monitoring at no cost
Advising the affected residents about the process for placing fraud alerts and/or security freezes on their credit files
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 22 weeks(153 days from discovery to filing)
Compliance flags: Leak >90d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

HHS OCRApr 6 · first

Nebraska State AGApr 6 · first

Maine State AGApr 6 · first

New Hampshire State AG+7d · this page

Pattern: first filing Apr 6 (AL), last Apr 13 (NH) — a 7-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/heart-south-cardiovascular-20260413.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 13, 2026
Raw hash: 2840758b801140fc07c65d4e5422d8ac4fcc5bb2fbd486e5dd38bf99272a8554

Linked disclosures

Ransomware claims (1)

Regulatory filings (3) · sorted by filing gap

Reporting entityMCDONALD HOPKINS LLC

Victim entityHeart South Cardiovascular Group

Incidentdiscovered Nov 11, 2025

Stated responseCommenced a prompt and thorough forensic investigation with external cybersecurity professionals

ComplianceLeak >90d

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov