Social EngineeringPhishingCustomer Data InvolvedEmployee Data InvolvedIDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTHEALTH_BASICMediumContained
Menninger Clinic
bd_84f3fcdb9d649d1f · schema v1 · pii pii-v1
Full breach record for Menninger Clinic →The Menninger Clinic, a psychiatric hospital in Houston, Texas, notified the New Hampshire Attorney General of a data security incident discovered on March 30, 2021. Unauthorized access to employee email accounts resulted in the exposure of personal and health information for one New Hampshire resident. The clinic engaged cybersecurity firms, reported the incident to federal and local law enforcement, and implemented enhanced security measures including multi-factor authentication.
This filing is one of 4 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (3) · sorted by filing gap
- bd_fde2a588649e877dMaine State AGfiled 2021-09-28(3d gap)Verified
- bd_5f691a4f7353b06bHHS OCRfiled 2021-09-24(7d gap)Verified
- bd_ae4185c299e32c9fMontana State AGfiled 2021-09-24(7d gap)Verified
Source provenance
- Source URL
- https://mm.nh.gov/files/uploads/doj/remote-docs/menninger-clinic-20211001.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Oct 1, 2021
- Raw hash
- c55d65e42f4bcb63459fa98c3a8ce87d47af8ceaf854b99583c69f3bc46b38eb
Reporting entity
- Name
- Lewis Brisbois Bisgaard & Smith, PLLCnorm: lewis brisbois bisgaard smith
Victim entity
- Name
- Menninger Clinicnorm: menninger clinic
- Domain
- menningerclinic.org
Incident
- Discovered
- Mar 30, 2021
- Materiality determined
- —
- Notification sent
- Sep 24, 2021
- Affected individuals
- 1
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTHEALTH_BASIC
- Attack vector
- Phishing
- MITRE ATT&CK
- T1566.002 Spearphishing LinkT1078 Valid Accounts
- Threat actor
- External
- Regulator citations
- Reported the incident to the Federal Bureau of Investigation, the Department of Homeland Security, and the Houston Police Department
- Initial access
- phishing_link
Compliance
- Time to disclose
- 26 weeks(185 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.