MalwareHealthcareHealthcareRansomwareStolen CredentialsData ExfiltratedRansom DemandedMulti-Stage ChainIdentity (basic)Government IDHealth (basic)Financial accountMediumContained

TriValley Primary Care

bd_73d56fd3791115e5 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Oct 11, 2021

Filed

Jan 10, 2022

To disclose

13 weeks

Affected

29state residents only

Linked

9 records

Confidence

67%

Full breach record for TriValley Primary Care →

TriValley Primary Care filed a supplemental notice with the New Hampshire Attorney General regarding a ransomware incident discovered on October 11, 2021. The filing adds 18 New Hampshire residents to the count, bringing the total state-affected individuals to 29. The breach exposed PHI, SSNs, and financial data. The organization engaged forensic experts and the FBI, and is providing credit monitoring.

J jump to incidentP pin to compareR raw source

Leak gap clock⏱ Leak >30d13 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

discovery → filing · 13 weeks / 91 days

Oct 11, 2021

Discovered

Jan 10, 2022

Filed

vs. sector median

+4 wks slower

This filing is one of 9 records about the same incident.View merged incident

A leak claim by groove about this victim was first seen 80 days before this filing.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitegroovebd_8f00d88f589e8adc2021-10-22 · +80dVerified by operator

Regulatory filings (7) · sorted by filing gap

Maine State AGbd_c3d99a75329756c92022-01-06 · +4dVerified
New Hampshire State AGbd_d568aa2fb9b57c252021-11-29 · +42dVerified by operator
Indiana State AGbd_28314db61f2a77272021-11-24 · +47dVerified by operator
Massachusetts State AGbd_5493e351799774fd2021-11-23 · +48dVerified by operator

Show 3 more filings ↓up to 48d gap

Maine State AGbd_a109c87c50e4d2872021-11-23 · +48dVerified
HHS OCRbd_a1e10af133af49312021-11-23 · +48dVerified
Montana State AGbd_db12c7445a73ebb62021-11-23 · +48dVerified

Name: Whiteford, Taylor & Preston LLP
norm: whiteford taylor preston
Domain: whitefordlaw.com

Name: TriValley Primary Care
norm: trivalley primary care
Domain: trivalleypc.com
Industry: Healthcarellm

Discovered: Oct 11, 2021
Materiality determined: —
Notification sent: Jan 7, 2022
Affected individuals: 29state-resident count only
Data types: Identity (basic)Government IDHealth (basic)Financial account
Data elements: Date of birthMedical information
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney GeneralContacted the FBI
Initial access: valid_credentials

During the incident: Engaged outside counsel and third-party forensic experts
Contacted the FBI
Secured and safely restored systems and operations
Mailed written notification to affected residents
Provided free access to credit monitoring services for one year through Sontiq
Changes made: Implementing additional safeguards to existing cybersecurity infrastructure
Enhancing employee cybersecurity training
Working with cybersecurity experts to improve cybersecurity policies, procedures, and protocols
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 13 weeks(91 days from discovery to filing)
Compliance flags: Leak >30d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 6 states

View merged incident ↗

Massachusetts State AGNov 23 · first

Maine State AGNov 23 · first

HHS OCRNov 23 · first

Montana State AGNov 23 · first

Indiana State AG+1d

New Hampshire State AG+6d

Maine State AG+44d

New Hampshire State AG+48d · this page

Pattern: first filing Nov 23 (MA), last Jan 10 (NH) — a 48-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/trivalley-primary-care-20220110.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 10, 2022
Raw hash: d8c5f4da8f0a46d133920bef143705db3b5598cab26b5623463e8b97b85cfe27

Linked disclosures

Ransomware claims (1)

Regulatory filings (7) · sorted by filing gap

Reporting entityWhiteford, Taylor & Preston LLP

Victim entityTriValley Primary Care

Incidentdiscovered Oct 11, 2021

Stated responseEngaged outside counsel and third-party forensic experts

ComplianceLeak >30d

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov