HackingStolen CredentialsData ExfiltratedDelayed DiscoveryCustomer Data InvolvedIDENTITY_GOVERNMENTIDENTITY_BASICHEALTH_BASICCriticalActive
MCG Health, LLC
bd_7b1a709405fc53f9 · schema v1 · pii pii-v1
Full breach record for MCG Health, LLC →MCG Health, LLC, a healthcare business associate, disclosed a breach affecting 1,100,000 individuals. Unauthorized parties obtained patient/member data (SSNs, names, medical codes, PII) matching MCG's systems. The breach occurred around Feb 25-26, 2020, but was discovered March 25, 2022. MCG retained forensic investigators, coordinated with the FBI, and offers two years of Experian credit monitoring.
Maine clockDiscovered Mar 25, 2022 → Filed with AG Jun 10, 202277d ⏱ ME AG >30d11 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
This filing is one of 5 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (4) · sorted by filing gap
- bd_0a30370a2ec4495dHHS OCRfiled 2022-06-10Verified
- bd_345bdaa71a2ac5fbMontana State AGfiled 2022-06-10Verified
- bd_a0380ae2d23fe355Maine State AGfiled 2022-06-21(11d gap)Verified
- bd_8779641a7cb24f1aMontana State AGfiled 2022-06-27(17d gap)Verified
Source provenance
- Source URL
- https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/1948d82a-0cdb-4b37-a988-b4189351176b.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jun 10, 2022
- Raw hash
- 2e85318e4ee7bdd6b8f8cbdad460339299cb9014d2df119cbf0e91eef0ab3b22
Reporting entity
- Name
- MCG Health, LLCnorm: mcg health
- Domain
- mcg.com
Victim entity
- Name
- MCG Health, LLCnorm: mcg health
- Domain
- mcg.com
Incident
- Discovered
- Mar 25, 2022
- Materiality determined
- —
- Notification sent
- Jun 10, 2022
- Affected individuals
- 1,100,000
- Data types
- IDENTITY_GOVERNMENTIDENTITY_BASICHEALTH_BASIC
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1078 Valid Accounts
- Threat actor
- External
- Regulator citations
- MCG is coordinating with the FBI
- Initial access
- valid_credentials
Compliance
- Time to disclose
- 11 weeks(77 days from discovery to filing)
- Compliance flags
- ME AG >30d · 77dME resident >60d · 77d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
- Clock breakdown
Statute Window Elapsed Threshold Status Maine Discovered: Mar 25, 2022→ Filed with AG: Jun 10, 202277d 30 days (soft) ME AG >30d Maine Discovered: Mar 25, 2022→ Notified: Jun 10, 202277d 60 days (analyst band; statutory cap is 30 days) ME resident >60d
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.