HackingHealthcareHealthcareStolen CredentialsData ExfiltratedDelayed DiscoveryCustomer Data InvolvedGovernment IDIdentity (basic)Health (basic)CriticalActive

MCG Health, LLC

bd_7b1a709405fc53f9 · schema v1 · pii pii-v1

Severity

Critical

Discovered

Mar 25, 2022

Filed

Jun 10, 2022

To disclose

11 weeks

Affected · nationwide

1,100,00017 in this filing

Linked

11 filings

Confidence

66%

Full breach record for MCG Health, LLC →

MCG Health, LLC, a healthcare business associate, disclosed a breach affecting 1,100,000 individuals. Unauthorized parties obtained patient/member data (SSNs, names, medical codes, PII) matching MCG's systems. The breach occurred around Feb 25-26, 2020, but was discovered March 25, 2022. MCG retained forensic investigators, coordinated with the FBI, and offers two years of Experian credit monitoring.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Mar 25, 2022 → Filed with AG Jun 10, 202277d ⏱ ME AG >30d11 weeks discovery → filing

Incident timeline

undetected · 759 days

discovery → filing · 11 weeks / 77 days

Feb 25, 2020

Begins

Mar 25, 2022

Discovered

Jun 10, 2022

Filed

vs. sector median

2 wks faster

This filing is one of 11 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

Indiana State AGbd_04114e3688672cef2022-06-10Verified
HHS OCRbd_0a30370a2ec4495d2022-06-10Verified
Montana State AGbd_345bdaa71a2ac5fb2022-06-10Verified
Massachusetts State AGbd_b99d1929a95c95f92022-06-10Verified

Show 6 more filings ↓up to 160d gap

Idaho State AGbd_a83f0caaa719a65b2022-06-13 · +3dVerified
Maine State AGbd_a0380ae2d23fe3552022-06-21 · +11dVerified
Montana State AGbd_8779641a7cb24f1a2022-06-27 · +17dVerified
New Hampshire State AGbd_ab2f3099d15b3ab82022-07-08 · +28dVerified
Illinois State AGbd_8cb2b43da00a45df2022-01-01 · +160dCandidate
Illinois State AGbd_9097fcbc166e7a792022-01-01 · +160dVerified

Name: MCG Health, LLC
norm: mcg health
Domain: mcg.com

Name: MCG Health, LLC
norm: mcg health
Domain: mcg.com
Industry: Healthcarellm

Discovered: Mar 25, 2022
Breach occurred: Feb 25, 2020 – Feb 26, 2020
Undetected for: 759 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 10, 2022
Affected individuals: 1,100,000state + nationwide
Data types: Government IDIdentity (basic)Health (basic)
Data elements: Social Security numberDate of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: MCG is coordinating with the FBI
Initial access: valid_credentials

During the incident: A leading forensic investigation firm was retained to assist in the investigation
MCG is coordinating with the FBI
Deployed additional monitoring tools
Continues to enhance the security of its systems
Offering identity protection and credit monitoring services through Experian for two years at no cost
Changes made: Deployed additional monitoring tools
Continues to enhance the security of its systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 11 weeks(77 days from discovery to filing)
Compliance flags: ME AG >30d · 77d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Mar 25, 2022
→ Filed with AG: Jun 10, 2022
77d 30 days (soft) ME AG >30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Mar 25, 2022 → Filed with AG: Jun 10, 2022	77d	30 days (soft)	ME AG >30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 8 states

View merged incident ↗

Illinois State AGJan 1 · first

Indiana State AG+160d

HHS OCR+160d

Montana State AG+160d

Massachusetts State AG+160d

Maine State AG+160d · this page

Idaho State AG+163d

Maine State AG+171d

Montana State AG+177d

New Hampshire State AG+188d

Pattern: first filing Jan 1 (IL), last Jul 8 (NH) — a 188-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/1948d82a-0cdb-4b37-a988-b4189351176b.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 10, 2022
Raw hash: 2e85318e4ee7bdd6b8f8cbdad460339299cb9014d2df119cbf0e91eef0ab3b22

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entityMCG Health, LLC

Victim entityMCG Health, LLC

Incidentdiscovered Mar 25, 2022

Stated responseA leading forensic investigation firm was retained to assist in the investigation

ComplianceME AG >30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov