HackingHealthcareProfessional ServicesHealthcareStolen CredentialsTargetedCustomer Data InvolvedIdentity (basic)Government IDMediumContained

Maxim Healthcare Group

bd_9109c9702d7b335a · schema v1 · pii pii-v1

Severity

Medium

Discovered

Dec 4, 2020

Filed

Nov 9, 2021

To disclose

49 weeks

Affected

2state residents only

Linked

6 filings

Confidence

66%

Full breach record for Maxim Healthcare Group →2 incidents on file

Maxim Healthcare Group notified the NH AG of unauthorized access to employee email accounts between Oct 1 and Dec 4, 2020. Discovered Dec 4, 2020. Affected data included names, addresses, and SSNs. 2 NH residents affected. Notices sent Nov 4, 2021. Response included forensic investigation, MFA implementation, and SOC transition.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 64 days

discovery → filing · 49 weeks / 340 days

Oct 1, 2020

Begins

Dec 4, 2020

Discovered

Nov 9, 2021

Filed

vs. sector median

+36 wks slower

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Massachusetts State AGbd_7e7022db4d247c0d2021-11-04 · +5dVerified
Indiana State AGbd_993c233bc90c033c2021-11-04 · +5dVerified
Montana State AGbd_c13dda61b32425472021-11-04 · +5dVerified
California State AGbd_df999b80ae34a55f2021-11-04 · +5dVerified

Show 1 more filing ↓up to 5d gap

HHS OCRbd_e749a80667f362da2021-11-04 · +5dVerified

Name: Mullen Coughlin LLC
norm: mullen coughlin

Name: Maxim Healthcare Group
norm: maxim healthcare
Industry: HealthcarellmProfessional Servicesllm

Discovered: Dec 4, 2020
Breach occurred: Oct 1, 2020 – Dec 4, 2020
Undetected for: 64 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 4, 2021
Affected individuals: 2state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: External
Regulator citations: Notified Office of the New Hampshire Attorney General
Initial access: valid_credentials

During the incident: Worked with outside forensic specialists to determine the full scope and impact of this event
Performed a detailed and thorough programmatic and manual review of the contents of the email accounts
Provided written notice of this incident to affected individuals
Issuing notice to certain media outlets and posting notice of this incident on its website
Notifying state and federal regulatory authorities
Changes made: Implementing additional safeguards and training to its employees
Instituted additional security protocols, including implementation of Multi-Factor Authentication for all email accounts
Transitioned to a new Security Operations Center with advanced detection and response capabilities
Integrating additional cybersecurity infrastructure and security measures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 49 weeks(340 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Massachusetts State AGNov 4 · first

Indiana State AGNov 4 · first

Montana State AGNov 4 · first

California State AGNov 4 · first

HHS OCRNov 4 · first

New Hampshire State AG+5d · this page

Pattern: first filing Nov 4 (MA), last Nov 9 (NH) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/maxim-healthcare--20211109.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 9, 2021
Raw hash: 1412a7ecf89c88548bd11a23abd2810cf23464071995d3e200c95092608166bb

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityMullen Coughlin LLC

Victim entityMaxim Healthcare Group

Incidentdiscovered Dec 4, 2020

Stated responseWorked with outside forensic specialists to determine the full scope and impact of this event

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov