Social EngineeringPhishingData ExfiltratedCustomer Data InvolvedDelayed DiscoveryPIIIDENTITY_BASICIDENTITY_GOVERNMENTMediumContained
NOW Health Group, Inc.
bd_72d3e903b50af70b · schema v1 · pii pii-v1
Full breach record for NOW Health Group, Inc. →NOW Health Group, Inc. notified New Hampshire residents on September 5, 2023, regarding a cybersecurity incident discovered on March 17, 2023. Unauthorized access occurred between March 17 and March 20, 2023, affecting employee email accounts containing personal information of two New Hampshire residents. The breach involved phishing leading to unauthorized email access. NOW secured accounts, engaged in investigation, and provided 12 months of credit monitoring via Experian. HIPAA notification was also sent to HHS.
This filing is one of 3 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (2) · sorted by filing gap
- bd_be1a1c2ae8069fd7Montana State AGfiled 2023-09-05Candidate
- bd_f8ac55cb88291233Maine State AGfiled 2023-09-05Candidate
Source provenance
- Source URL
- https://mm.nh.gov/files/uploads/doj/remote-docs/now-health-group-20230905.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Sep 5, 2023
- Raw hash
- b6eced08f37e30e823889603319e5e58b092c207086d6d0c9dbe41700822c628
Reporting entity
- Name
- NOW Health Group, Inc.norm: now health
Victim entity
- Name
- NOW Health Group, Inc.norm: now health
Incident
- Discovered
- Mar 17, 2023
- Materiality determined
- —
- Notification sent
- Sep 5, 2023
- Affected individuals
- 2
- Data types
- PIIIDENTITY_BASICIDENTITY_GOVERNMENT
- Attack vector
- Phishing
- MITRE ATT&CK
- T1566.002 Spearphishing Link
- Threat actor
- External
- Regulator citations
- providing written notice of this incident to relevant state and federal regulatorsnotifying the U.S. Department of Health and Human Services pursuant to the Health Insurance Portability and Accountability Act (HIPAA)
- Initial access
- phishing_link
Compliance
- Time to disclose
- 25 weeks(172 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.