HackingData ExfiltratedCustomer Data InvolvedPHIHEALTH_BASICIDENTITY_GOVERNMENTIDENTITY_BASICMediumContained
Duncan Regional Hospital, Inc.
bd_8e12f6dc142dcf3d · schema v1 · pii pii-v1
Full breach record for Duncan Regional Hospital, Inc. →Duncan Regional Hospital, Inc. (DRH) notified the New Hampshire Attorney General on March 4, 2022, of a data security incident detected on January 20, 2022. The incident potentially exposed patient and employee information, including names, dates of birth, Social Security numbers, and limited treatment data. Four New Hampshire residents were affected. DRH disconnected systems, engaged forensic investigators, and provided credit monitoring via Experian to affected individuals.
This filing is one of 5 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (4) · sorted by filing gap
- bd_379ce2137f1b8b8eHHS OCRfiled 2022-03-04Verified
- bd_951471bd831a875bMaine State AGfiled 2022-03-04Verified
- bd_e83433683660598aMontana State AGfiled 2022-03-04Verified
- bd_9cf8dc6e97bedca7Maine State AGfiled 2022-03-03(1d gap)Verified
Source provenance
- Source URL
- https://mm.nh.gov/files/uploads/doj/remote-docs/duncan-regional-hospital-20220304.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Mar 4, 2022
- Raw hash
- 713e41f18fd9bcce954aca46ededa0992cb3ff5dda69df082b47dc597460d725
Reporting entity
- Name
- Duncan Regional Hospital, Inc.norm: duncan regional hospital
Victim entity
- Name
- Duncan Regional Hospital, Inc.norm: duncan regional hospital
Incident
- Discovered
- Jan 20, 2022
- Materiality determined
- —
- Notification sent
- Mar 4, 2022
- Affected individuals
- 4
- Data types
- PHIHEALTH_BASICIDENTITY_GOVERNMENTIDENTITY_BASIC
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1190 Exploit Public-Facing Application
- Threat actor
- External
- Regulator citations
- Notice will also be provided to the Department of Health and Human Services Office of Civil Rights
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 6 weeks(43 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.