AccidentalHealthcareProfessional ServicesHealthcareMisdeliveryEmployee Data InvolvedPIIGovernment IDEmploymentMediumResolved

Clinton Health Access Initiative

bd_77fddf5a314a6edb · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 20, 2013

Filed

Mar 29, 2013

To disclose

9 days

Affected · nationwide

1071 in this filing

Linked

2 filings

Confidence

67%

Full breach record for Clinton Health Access Initiative →4 incidents on file

Clinton Health Access Initiative (CHAI) reported an information security breach to the NH Attorney General on March 29, 2013. On March 20, 2013, CHAI discovered it inadvertently emailed Form W-2s containing names, SSNs, and wage info of 107 employees to an unintended internal recipient. Notifications were sent on March 28, 2013, including credit monitoring. One NH resident was affected.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 9 days

Mar 20, 2013

Discovered

Mar 29, 2013

Filed

vs. sector median

11 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_38229512c8826e9e2013-04-01 · +3dVerified

Name: Clinton Health Access Initiative
norm: clinton health access initiative
Domain: clintonhealthaccess.org

Name: Clinton Health Access Initiative
norm: clinton health access initiative
Domain: clintonhealthaccess.org
Industry: HealthcarellmProfessional Servicesllm

Discovered: Mar 20, 2013
Materiality determined: —
Notification sent: Mar 28, 2013
Affected individuals: 107state + nationwide
Data types: PIIGovernment IDEmployment
Attack vector: Misconfiguration
MITRE ATT&CK: T1534 Internal Remote Services
Threat actor: Internal
Regulator citations: Notified New Hampshire Attorney General

During the incident: Contacted the recipient
Recipient confirmed that the e-mail has been deleted
Mailed written notifications to all affected New Hampshire residents
Provided complimentary credit monitoring services
Reviewing data security policies
Changes made: Reviewing data security policies to reduce the likelihood of future data breaches
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 days(9 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

New Hampshire State AGMar 29 · first · this page

Massachusetts State AG+3d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/clinton-health-access-20130329.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 29, 2013
Raw hash: cd6ff0e5e699e2f32d234a3cd5b2825077bf6d18d5e77e1ef307ea7c8e02e56f

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityClinton Health Access Initiative

Victim entityClinton Health Access Initiative

Incidentdiscovered Mar 20, 2013

Stated responseContacted the recipient

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov