HackingHealthcareHealthcareCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Government IDFinancial accountHealth (basic)PHIMediumContained

New Horizons Medical

bd_85e540f0e1a7170b · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 19, 2023

Filed

Jun 16, 2023

To disclose

8 weeks

Affected

Not disclosed

Linked

9 filings

Confidence

64%

Full breach record for New Horizons Medical →

New Horizons Medical, Inc. reported unauthorized access to its IT network between Feb 12 and Apr 23, 2023. Patient data including names, SSNs, driver's licenses, financial accounts, and medical records were potentially accessed. The company engaged a cybersecurity firm and offered one year of Experian IdentityWorks. No misuse was known at the time of notification.

J jump to incidentP pin to compareR raw source

Vermont clock⏱ VT AG >14 bday8 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 66 days

discovery → filing · 8 weeks / 58 days

Feb 12, 2023

Begins

Apr 19, 2023

Discovered

Jun 16, 2023

Filed

vs. sector median

4 wks faster

This filing is one of 9 about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (4)

Leak Sitealphvbd_c4d7bd95b435f5f42023-06-14 · +2dVerified by operator
Leak Sitedevmanbd_71eba06beb388d582023-06-07 · +9dVerified by operator
Leak Sitelockbit_3bd_d939fd288e09f9b12023-06-07 · +9dVerified by operator
Leak Sitedispossessorbd_ee19ff23a51a6b662023-06-07 · +9dVerified by operator

Regulatory filings (4) · sorted by filing gap

Maine State AGbd_21b6640148a7de432023-06-16Verified
Massachusetts State AGbd_2609f3811437b01b2023-06-16Verified
HHS OCRbd_dafbd369b767e2b22023-06-16Verified
New Hampshire State AGbd_fec539caa70161d52023-06-16Verified

Name: New Horizons Medical
norm: new horizons medical
Domain: newhorizonsmedical.org

Name: New Horizons Medical
norm: new horizons medical
Domain: newhorizonsmedical.org
Industry: Healthcarellm

Discovered: Apr 19, 2023
Breach occurred: Feb 12, 2023 – Apr 23, 2023
Undetected for: 66 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 15, 2023
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDFinancial accountHealth (basic)PHI
Data elements: Social Security numberDate of birthMedical information
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1119 Automated Collection
Threat actor: External
Initial access: exploit_public_facing

During the incident: Engaged a cybersecurity firm to assist
Offering you a complimentary one-year membership in Experian’s IdentityWorks
Changes made: Implemented and will continue to adopt additional safeguards and technical security measures to further protect and monitor our systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(58 days from discovery to filing)
Compliance flags: VT AG >14 bday
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 4 states

View merged incident ↗

Maine State AGJun 16 · first

Massachusetts State AGJun 16 · first

HHS OCRJun 16 · first

New Hampshire State AGJun 16 · first

Vermont State AGJun 16 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ago.vermont.gov/document/2023-06-16-new-horizons-medical-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 16, 2023
Raw hash: dc4651c4f07cecfde19ce02b2e3db7ca2fd3a6ce18d909cd48803fc1d17a967b

Linked disclosures

Ransomware claims (4)

Regulatory filings (4) · sorted by filing gap

Reporting entityNew Horizons Medical

Victim entityNew Horizons Medical

Incidentdiscovered Apr 19, 2023

Stated responseEngaged a cybersecurity firm to assist

ComplianceVT AG >14 bday

Extraction provenanceno artifact recorded

Source provenanceago.vermont.gov