HackingHealthcareHealthcarePIIGovernment IDHighContained

Coastal Family Health Center

bd_723a63311f80ff8f · schema v1 · pii pii-v1

Severity

High

Discovered

May 13, 2021

Filed

Jul 7, 2021

To disclose

8 weeks

Affected · nationwide

62,3424 in this filing

Linked

6 filings

Confidence

50%

Full breach record for Coastal Family Health Center →

Coastal Family Health Center reported a data breach affecting 4 Maine residents. The breach, which was discovered on May 13, 2021, involved an external system breach (hacking) where threat actors gained access to names and Social Security numbers. The company offered 12 months of credit and identity monitoring services through IDX to the affected individuals.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered May 13, 2021 → Filed with AG Jul 7, 202155d ⏱ ME AG >30d8 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 8 weeks / 55 days

May 13, 2021

Begins

May 13, 2021

Discovered

Jul 7, 2021

Filed

vs. sector median

4 wks faster

This filing is one of 6 about the same incident.View merged incident

A leak claim by xinglocker about this victim predates this filing by 44 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitexinglockerbd_88b610dc9d1985742021-05-24 · +44dVerified by operator

Regulatory filings (4) · sorted by filing gap

Massachusetts State AGbd_a90627b06a9a9fc02021-07-07Verified by operator
Indiana State AGbd_cb5d26778626afb32021-07-06 · +1dVerified by operator
Montana State AGbd_db7984f9be2383522021-07-06 · +1dVerified by operator
HHS OCRbd_139c3192f3bd37e62021-07-02 · +5dVerified by operator

Name: Coastal Family Health Center
norm: coastal family health center

Name: Coastal Family Health Center
norm: coastal family health center
Industry: Healthcarellm

Discovered: May 13, 2021
Breach occurred: May 13, 2021
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 6, 2021
Affected individuals: 62,342state + nationwide
Data types: PIIGovernment ID
Data elements: Social Security number
Attack vector: Unauthorized Access

Changes made: Offered 12 months of credit and identity monitoring services through IDX.
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(55 days from discovery to filing)
Compliance flags: ME AG >30d · 55dLeak >30d
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: May 13, 2021
→ Filed with AG: Jul 7, 2021
55d 30 days (soft) ME AG >30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: May 13, 2021 → Filed with AG: Jul 7, 2021	55d	30 days (soft)	ME AG >30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

HHS OCRJul 2 · first

Indiana State AG+4d

Montana State AG+4d

Massachusetts State AG+5d

Maine State AG+5d · this page

Pattern: first filing Jul 2 (MS), last Jul 7 (ME) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/874f68de-59e6-4661-8863-bbdfb06d4176.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 7, 2021
Raw hash: 4770267fd5157e7d67c4e53122fdbe2c961487276b046f6cd9c77eb08d842143

Linked disclosures

Ransomware claims (1)

Regulatory filings (4) · sorted by filing gap

Reporting entityCoastal Family Health Center

Victim entityCoastal Family Health Center

Incidentdiscovered May 13, 2021

Stated responseOffered 12 months of credit and identity monitoring services through IDX.

ComplianceME AG >30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov