Social EngineeringHealthcareHealthcarePhishingStolen CredentialsTargetedCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDHealth (basic)CredentialsMediumContained

PIH HEALTH, INC.

bd_8571a8c5bf1cf1e8 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 18, 2019

Filed

Jan 10, 2020

To disclose

29 weeks

Affected

3state residents only

Linked

7 filings

Confidence

66%

Full breach record for PIH HEALTH, INC. →5 incidents on file

PIH Health notified the NH AG of a phishing incident affecting 3 NH residents. Unauthorized access to employee email accounts occurred June 11-19, 2019. Exposed data included names, driver's licenses, medical info, and credentials. Notifications mailed Jan 9-10, 2020.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 7 days

discovery → filing · 29 weeks / 206 days

Jun 11, 2019

Begins

Jun 18, 2019

Discovered

Jan 10, 2020

Filed

vs. sector median

+17 wks slower

This filing is one of 7 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

Massachusetts State AGbd_27d7777e802fa91b2020-01-10Verified
HHS OCRbd_4a28b4853227a5ed2020-01-10Verified
California State AGbd_a21953b1532e9ead2020-01-10Verified
Indiana State AGbd_affe7d5b7013704d2020-01-10Verified

Show 2 more filings ↓up to 1930d gap

Illinois State AGbd_a91cc01f9afd40902020-01-01 · +9dCandidate
HHS OCR enforcementbd_86698e91d73c9fe22025-04-23 · +1930dVerified by operator

Name: PIH HEALTH, INC.
norm: pih health

Name: PIH HEALTH, INC.
norm: pih health
Industry: Healthcarellm

Discovered: Jun 18, 2019
Breach occurred: Jun 11, 2019 – Jun 19, 2019
Undetected for: 7 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 9, 2020
Affected individuals: 3state-resident count only
Data types: Identity (basic)Government IDHealth (basic)Credentials
Data elements: Medical information
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Office of the Attorney General
Initial access: phishing_link

During the incident: Reset the passwords required to access the employee email accounts
Implemented additional email and network security measures
Engaged leading, independent cybersecurity experts to determine what happened
Deploying an incident response team and protocol based upon the NIST framework
Enabling new email security appliances
Immediately changing passwords for affected individuals and high risk accounts
Reinforcing two-factor authentication where available
Implementing additional training to guard against phishing attacks
Changes made: Revising PIH’s policies and procedures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 29 weeks(206 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 5 states

View merged incident ↗

Illinois State AGJan 1 · first

Massachusetts State AG+9d

HHS OCR+9d

California State AG+9d

Indiana State AG+9d

New Hampshire State AG+9d · this page

HHS OCR enforcement+1939d

Pattern: first filing Jan 1 (IL), last Apr 23 — a 1939-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/pih-health-20200110.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 10, 2020
Raw hash: 5608ca3fe9b7b278c5e02af2f9433bc08eccb2c8d3d08181fed9da7971051796

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityPIH HEALTH, INC.

Victim entityPIH HEALTH, INC.

Incidentdiscovered Jun 18, 2019

Stated responseReset the passwords required to access the employee email accounts

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov