HackingHealthcareHealthcareStolen CredentialsCapture Stored DataData ExfiltratedCustomer Data InvolvedTargetedIdentity (basic)Government IDPHIHealth (basic)HighContained

Mid Florida Primary Care

bd_804512335ec0db12 · schema v1 · pii pii-v1

Severity

High

Discovered

Jan 23, 2025

Filed

Aug 4, 2025

To disclose

28 weeks

Affected · nationwide

16,43516 in this filing

Linked

6 filings

Confidence

64%

Full breach record for Mid Florida Primary Care →2 incidents on file

Mid Florida Primary Care, PA reported a data breach affecting 16,435 individuals, including 16 New Hampshire residents. Unauthorized access occurred between Nov 29 and Dec 11, 2024, discovered Jan 23, 2025. Exposed data included names, SSNs, driver's licenses, and PHI. The organization engaged forensic investigators, secured its network, and offered 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Leak gap clock✗ Leak >180d28 weeks discovery → filing

Incident timeline

undetected · 55 days

discovery → filing · 28 weeks / 193 days

Nov 29, 2024

Begins

Jan 23, 2025

Discovered

Jun 19, 2025

Scope determined

Aug 4, 2025

Filed

vs. sector median

+15 wks slower

This filing is one of 6 about the same incident.View merged incident

A leak claim by bianlian about this victim predates this filing by 236 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (2)

Leak Sitebianlianbd_3882f076ec3fd20a2024-12-14 · +232dVerified by operator
Leak Sitebianlianbd_d03991ce7d7ba3682024-12-11 · +236dVerified by operator

Regulatory filings (3) · sorted by filing gap

Vermont State AGbd_1340dbb6985b20512025-07-29 · +6dVerified by operator
Massachusetts State AGbd_461ba58468cd74512025-07-29 · +6dVerified by operator
HHS OCRbd_b19ae17c664f8fc62025-03-21 · +136dVerified

Name: Mid Florida Primary Care
norm: mid florida primary care
Domain: mymfpc.com

Name: Mid Florida Primary Care
norm: mid florida primary care
Domain: mymfpc.com
Industry: Healthcarellm

Discovered: Jan 23, 2025
Breach occurred: Nov 29, 2024 – Dec 11, 2024
Undetected for: 55 daysoccurrence → discovery
Materiality determined: Jun 19, 2025
Notification sent: Jul 29, 2025
Affected individuals: 16,435state + nationwide
Data types: Identity (basic)Government IDPHIHealth (basic)
Data elements: Social Security numberMedical information
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney General Consumer Protection Bureau
Initial access: valid_credentials

During the incident: Engaged a specialized cybersecurity firm to conduct a forensic investigation
Retained legal counsel
Secured its network
Offered 12 months of complimentary credit monitoring and identity theft restoration services through AB Data
Provided guidance on how to better protect against identity theft and fraud
Changes made: Secured the services of Privacy Solutions to provide complimentary identity monitoring
Provided information on how to place a fraud alert and security freeze on one's credit file
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 28 weeks(193 days from discovery to filing)
Compliance flags: Leak >180d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

HHS OCRMar 21 · first

Vermont State AG+130d

Massachusetts State AG+130d

New Hampshire State AG+136d · this page

Pattern: first filing Mar 21 (FL), last Aug 4 (NH) — a 136-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/mid-florida-primary-care-20250804.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 4, 2025
Raw hash: e5f81f5065ce566ce077e94ce163a95e6807be829786454039b0fb667cedb1c2

Linked disclosures

Ransomware claims (2)

Regulatory filings (3) · sorted by filing gap

Reporting entityMid Florida Primary Care

Victim entityMid Florida Primary Care

Incidentdiscovered Jan 23, 2025

Stated responseEngaged a specialized cybersecurity firm to conduct a forensic investigation

ComplianceLeak >180d

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov