MalwareHealthcareHealthcareRansomwareData EncryptedData ExfiltratedCustomer Data InvolvedEmployee Data InvolvedGovernment IDIdentity (basic)FinancialMediumContained

National Association of Community Health Centers

bd_80c9fe2c0113f867 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Oct 5, 2021

Filed

Jan 7, 2022

To disclose

13 weeks

Affected

2state residents only

Linked

3 filings

Confidence

66%

Full breach record for National Association of Community Health Centers →

National Association of Community Health Centers (NACHC) notified the New Hampshire Attorney General on January 7, 2022, of a cyberattack affecting two NH residents. Threat actors gained access around October 4, 2021, and encrypted servers (ransomware). Employee PII (SSNs, names, DOB, salary) was stored on compromised servers. NACHC engaged forensic investigators, notified law enforcement (FBI/DHS), and is offering 24 months of credit monitoring. No evidence of data exfiltration was found.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 1 days

discovery → filing · 13 weeks / 94 days

Oct 4, 2021

Begins

Oct 5, 2021

Discovered

Jan 7, 2022

Filed

vs. sector median

+1 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Maine State AGbd_3e77cb306d9cd7b42022-01-07Candidate
Indiana State AGbd_7e85b6d8dd4635632022-01-10 · +3dVerified

Name: Feldesman Tucker Leifer Fidell LLP
norm: feldesman tucker leifer fidell

Name: National Association of Community Health Centers
norm: national association of community health centers
Industry: Healthcarellm

Discovered: Oct 5, 2021
Breach occurred: Oct 4, 2021
Undetected for: 1 dayoccurrence → discovery
Materiality determined: —
Notification sent: Jan 10, 2022
Affected individuals: 2state-resident count only
Data types: Government IDIdentity (basic)Financial
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney General Consumer Protection Bureau
Initial access: valid_credentials

During the incident: Took the server offline
Launched an internal investigation
Engaged an outside cybersecurity firm to conduct a comprehensive investigation
Reported the cyberattacks to law enforcement (including the FBI, the Department of Homeland Security, the Department of Treasury and the local police)
Notifying users about the incident
Requiring users to change their passwords
Changes made: Moving systems to third-party hosted environments (when possible)
Implementing two-factor authentication
Contracting with a cybersecurity firm to implement preventive measures, such as monitoring, testing and auditing of our systems on an individual and network level
Offering 24 months of free credit monitoring and identity theft recovery services
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 13 weeks(94 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Maine State AGJan 7 · first

New Hampshire State AGJan 7 · first · this page

Indiana State AG+3d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/national-association-community-health-centers-20220107.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 7, 2022
Raw hash: bd2404526ea53e85071b7251e3cf29d05091e394fa40113c67e5ee133b43096c

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityFeldesman Tucker Leifer Fidell LLP

Victim entityNational Association of Community Health Centers

Incidentdiscovered Oct 5, 2021

Stated responseTook the server offline

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov