HackingHealthcareHealthcareStolen CredentialsSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Government IDFinancial accountHealth (basic)MediumContained

Hamilton Health Care System, Inc.

bd_90982dd7c17d8986 · schema v1 · pii pii-v2

Severity

Medium

Discovered

Feb 24, 2025

Filed

Apr 14, 2025

To disclose

—

Affected

Not disclosed

Linked

2 filings

Confidence

65%

Full breach record for Hamilton Health Care System, Inc. →

Hamilton Health Care System (dba Vitruvian Health) notified affected individuals on April 14, 2025, regarding a data breach involving its third-party collection agency, Nationwide Recovery Service (NRS). NRS systems were compromised between July 5 and July 11, 2024, resulting in the exfiltration of patient data including names, SSNs, DOBs, financial account info, and medical records. Vitruvian Health was notified by NRS on February 24, 2025. Remediation includes enhanced security safeguards and identity theft protection services for affected patients.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 234 days

Jul 5, 2024

Begins

Feb 24, 2025

Discovered

Apr 14, 2025

Filed

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_3935661cfdc61e302025-04-16 · +2dCandidate

Name: Hamilton Health Care System, Inc.
norm: hamilton health care system

Name: Hamilton Health Care System, Inc.
norm: hamilton health care system
Industry: Healthcarellm

Discovered: Feb 24, 2025
Breach occurred: Jul 5, 2024 – Jul 11, 2024
Undetected for: 234 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 14, 2025
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDFinancial accountHealth (basic)
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notifications have been provided to law enforcement
Third party: via Nationwide Recovery Service (aNRS)
Initial access: valid_credentials

During the incident: NRS started an investigation and implemented security measures to stop the unauthorized access to NRS systems
Notifications have been provided to law enforcement and the credit monitoring bureaus
Offering identity theft protection services through IDX
Offering 12 months/24 months of credit and CyberScan monitoring
Offering $1,000,000 insurance reimbursement policy
Offering fully managed identity theft recovery services
Changes made: NRS has implemented additional data security safeguards
Reviewed its existing polices to improve its security posture
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Nebraska State AGApr 14 · first · this page

Massachusetts State AG+2d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://nebraska.gov/ago/data-breach/documents/2cf73edb-b231-4fa4-adf3-970c3fd7f17f.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 14, 2025
Raw hash: 67e6a578b72e82fb469ba754c222fee9fbb39a2c703779a971579aa1016f9069

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityHamilton Health Care System, Inc.

Victim entityHamilton Health Care System, Inc.

Incidentdiscovered Feb 24, 2025

Stated responseNRS started an investigation and implemented security measures to stop the unauthorized access to NRS systems

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancenebraska.gov