Social EngineeringHealthcareHealthcarePhishingCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDFinancial accountHealth (basic)MediumContained

Menninger Clinic

bd_84f3fcdb9d649d1f · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 30, 2021

Filed

Oct 1, 2021

To disclose

26 weeks

Affected

1state residents only

Linked

8 filings

Confidence

67%

Full breach record for Menninger Clinic →2 incidents on file

The Menninger Clinic, a psychiatric hospital in Houston, Texas, notified the New Hampshire Attorney General of a data security incident discovered on March 30, 2021. Unauthorized access to employee email accounts resulted in the exposure of personal and health information for one New Hampshire resident. The clinic engaged cybersecurity firms, reported the incident to federal and local law enforcement, and implemented enhanced security measures including multi-factor authentication.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 26 weeks / 185 days

Mar 30, 2021

Discovered

Oct 1, 2021

Filed

vs. sector median

+14 wks slower

This filing is one of 8 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (7) · sorted by filing gap

Maine State AGbd_4f03df701911c5e82021-10-04 · +3dVerified
Massachusetts State AGbd_a025016eb43092c22021-10-04 · +3dVerified
Maine State AGbd_fde2a588649e877d2021-09-28 · +3dVerified
HHS OCRbd_5f691a4f7353b06b2021-09-24 · +7dVerified

Show 3 more filings ↓up to 273d gap

Indiana State AGbd_63791bebcb25da112021-09-24 · +7dVerified
Montana State AGbd_ae4185c299e32c9f2021-09-24 · +7dVerified
Illinois State AGbd_a0d4e28b361fb2ae2021-01-01 · +273dCandidate

Name: Lewis Brisbois Bisgaard & Smith, PLLC
norm: lewis brisbois bisgaard smith

Name: Menninger Clinic
norm: menninger clinic
Domain: menningerclinic.org
Industry: Healthcarellm

Discovered: Mar 30, 2021
Materiality determined: —
Notification sent: Sep 24, 2021
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government IDFinancial accountHealth (basic)
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid Accounts
Threat actor: External
Regulator citations: Reported the incident to the Federal Bureau of Investigation, the Department of Homeland Security, and the Houston Police Department
Initial access: phishing_link

During the incident: Engaged a leading, independent cybersecurity firm to investigate what happened and to determine whether any Menninger information may have been impacted
Engaged a cybersecurity firm to review the contents of the impacted email accounts likely to contain personal information
Reported the incident to the Federal Bureau of Investigation, the Department of Homeland Security, and the Houston Police Department
Offering you complimentary identity protection services through IDX
Changes made: Implemented two-factor authentication throughout its environment
Blocked all network logons from outside of the United States
Implemented procedures to flag and analyze suspicious network activity
Implemented a secure e-mail encryption desktop plug-in to enable end-users to more easily send encrypted emails
Implemented various features of the Proofpoint tool to further harden Menninger’s networks
Conducted additional end-use training
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 26 weeks(185 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 7 states

View merged incident ↗

Illinois State AGJan 1 · first

HHS OCR+266d

Indiana State AG+266d

Montana State AG+266d

Maine State AG+270d

New Hampshire State AG+273d · this page

Maine State AG+276d

Massachusetts State AG+276d

Pattern: first filing Jan 1 (IL), last Oct 4 (MA) — a 276-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/menninger-clinic-20211001.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 1, 2021
Raw hash: c55d65e42f4bcb63459fa98c3a8ce87d47af8ceaf854b99583c69f3bc46b38eb

Linked disclosures

Regulatory filings (7) · sorted by filing gap

Reporting entityLewis Brisbois Bisgaard & Smith, PLLC

Victim entityMenninger Clinic

Incidentdiscovered Mar 30, 2021

Stated responseEngaged a leading, independent cybersecurity firm to investigate what happened and to determine whether any Menninger information may have been impacted

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov