HackingHealthcareHealthcareCustomer Data InvolvedEmployee Data InvolvedPIIPHIIdentity (basic)LowContained

MHMR Authority of Brazos Valley

bd_8fd70e87ceed898b · schema v1 · pii pii-v1

Severity

Low

Discovered

May 30, 2023

Filed

Jul 28, 2023

To disclose

8 weeks

Affected

10state residents only

Linked

7 filings

Confidence

66%

Full breach record for MHMR Authority of Brazos Valley →

MHMR Authority of Brazos Valley notified individuals of a November 2022 security incident disrupting computer systems. A forensic review completed May 30, 2023, identified potential access to personal and protected health information of employees and patients. Notices were sent July 17, 2023, offering credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 206 days

discovery → filing · 8 weeks / 59 days

Nov 5, 2022

Begins

May 30, 2023

Discovered

Jul 28, 2023

Filed

vs. sector median

4 wks faster

This filing is one of 7 about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitehivebd_6445d4c7067f42fe2022-12-22 · +218dVerified by operator

Regulatory filings (5) · sorted by filing gap

Indiana State AGbd_872d53b345374dec2023-07-28Candidate
Vermont State AGbd_90ead781bcdc39a12023-07-28Verified
Maine State AGbd_866ef8fd9da653d72023-08-01 · +4dVerified
Massachusetts State AGbd_f4bd3ec2e60be6502023-08-01 · +4dVerified

Show 1 more filing ↓up to 150d gap

HHS OCRbd_a7fe7a90c1c53edc2023-02-28 · +150dVerified

Name: MHMR Authority of Brazos Valley
norm: mhmr authority of brazos valley
Domain: mhmrabv.org

Name: MHMR Authority of Brazos Valley
norm: mhmr authority of brazos valley
Domain: mhmrabv.org
Industry: Healthcarellm

Discovered: May 30, 2023
Breach occurred: Nov 5, 2022
Undetected for: 206 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 17, 2023
Affected individuals: 10state-resident count only
Data types: PIIPHIIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Regulator citations: Cooperating with the FBI
Initial access: exploit_public_facing

During the incident: Engaged independent digital forensics and incident response experts
Reported the incident to law enforcement and is cooperating with the FBI
Offering credit monitoring and identity protection services through IDX at no cost
Changes made: Implemented measures to enhance the security of our environment
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(59 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

HHS OCRFeb 28 · first

Indiana State AG+150d

Vermont State AG+150d

Montana State AG+150d · this page

Maine State AG+154d

Massachusetts State AG+154d

Pattern: first filing Feb 28 (TX), last Aug 1 (MA) — a 154-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-notification-letter-490.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 28, 2023
Raw hash: 0ef6c1b6d971512a0775262639ef293f79e174d1b98d1c89905a568d1e888cb2

Linked disclosures

Ransomware claims (1)

Regulatory filings (5) · sorted by filing gap

Reporting entityMHMR Authority of Brazos Valley

Victim entityMHMR Authority of Brazos Valley

Incidentdiscovered May 30, 2023

Stated responseEngaged independent digital forensics and incident response experts

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov