DisclosureLens
MalwareHealthcareHealthcareRansomwareSupply Chain (3P Vendor)Data EncryptedCustomer Data InvolvedEmployee Data InvolvedRansom PaidPHIIdentity (basic)Government IDHealth (basic)EmploymentMediumResolved

NEIGHBORHOOD HEALTHCARE

bd_8aaf06ac833493f3 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Dec 3, 2020

Filed

Apr 8, 2021

To disclose

18 weeks

Affected

Not disclosed

Linked

5 filings

Confidence

64%
Full breach record for NEIGHBORHOOD HEALTHCARE3 incidents on file

Neighborhood Healthcare notified patients and employees of a ransomware attack on its third-party hosting provider, Netgain. The attacker gained unauthorized access to Netgain's environment starting November 24, 2020, and launched a ransomware attack on December 3, 2020, encrypting files. Netgain paid a ransom to the attacker. Neighborhood Healthcare learned of the attack on December 3, 2020, and confirmed on March 16, 2021, that patient PHI (including SSNs, names, DOBs, treatment info) and employee data (including SSNs, retirement info) were impacted. The organization engaged outside experts, transitioned hosting providers, and offered credit monitoring.

Incident timeline

undetected · 9 days
discovery → filing · 18 weeks / 126 days

Nov 24, 2020

Begins

Dec 3, 2020

Discovered

Apr 8, 2021

Filed

vs. sector median

+5 wks slower

This filing is one of 5 about the same incident.View merged incident
Part of Netgain Networks supply-chain incident (2021) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Filing propagation · 5 filings · 4 states

View merged incident ↗
Montana State AGApr 8 · first
Indiana State AGApr 8 · first
California State AGApr 8 · first · this page

Pattern: first filing Apr 8 (MT), last Apr 14 (CA) — a 6-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.