Social EngineeringHealthcareHealthcarePhishingStolen CredentialsCustomer Data InvolvedTargetedIdentity (basic)Government IDHealth (basic)Financial accountMediumContained

UnityPoint Health

bd_911dab7665ebb5b6 · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 31, 2018

Filed

Jul 30, 2018

To disclose

9 weeks

Affected

52state residents only

Linked

6 filings

Confidence

66%

Full breach record for UnityPoint Health →14 incidents on file

UnityPoint Health notified the NH Attorney General on July 30, 2018, of a phishing incident discovered May 31, 2018. Attackers gained access to employee email accounts between March 14 and April 3, 2018, potentially exposing PHI and PII (including SSNs and driver's licenses) of 52 NH residents. No misuse reported. Remediation included MFA, password resets, and employee training. Credit monitoring offered.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 78 days

discovery → filing · 9 weeks / 60 days

Mar 14, 2018

Begins

May 31, 2018

Discovered

Jul 30, 2018

Filed

vs. sector median

2 wks faster

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Massachusetts State AGbd_001ef817a39f7b6d2018-07-30Verified
Montana State AGbd_38c797e4e7408ca32018-07-30Verified
HHS OCRbd_799993f34d0de7d62018-07-30Verified
Montana State AGbd_f8f71ff026792fff2018-07-30Verified

Show 1 more filing ↓

California State AGbd_fb9da4101eacad042018-07-30Verified

Name: MCDONALD HOPKINS LLC
norm: mcdonald hopkins

Name: UnityPoint Health
norm: unitypoint health
Domain: unitypoint.org
Industry: Healthcarellm

Discovered: May 31, 2018
Breach occurred: Mar 14, 2018 – Apr 3, 2018
Undetected for: 78 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 30, 2018
Affected individuals: 52state-resident count only
Data types: Identity (basic)Government IDHealth (basic)Financial account
Data elements: Social Security numberDate of birthMedical information
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified the Secretary of the U.S. Department of Health and Human Services Office for Civil Rights
Initial access: phishing_link

During the incident: Launched an investigation with an expert computer forensics firm
Informed law enforcement agencies
Reset passwords for all compromised accounts
Conducted mandatory education for employees to help them recognize and avoid phishing emails
Added technology to identify suspicious external emails
Implemented multi-factor authentication
Provided written notification via U.S. Mail
Offered free credit monitoring services for one year
Provided dedicated call center support
Notified the Secretary of the U.S. Department of Health and Human Services Office for Civil Rights
Changes made: Implemented multi-factor authentication
Added technology to identify suspicious external emails
Conducted mandatory education for employees to help them recognize and avoid phishing emails
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(60 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 5 states

View merged incident ↗

Massachusetts State AGJul 30 · first

Montana State AGJul 30 · first

HHS OCRJul 30 · first

Montana State AGJul 30 · first

California State AGJul 30 · first

New Hampshire State AGJul 30 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/unitypoint-20180730.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 30, 2018
Raw hash: 386d7050baa16a115007f0ec1aacaed940e09ecf40fafe94660d3bfdab691850

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityMCDONALD HOPKINS LLC

Victim entityUnityPoint Health

Incidentdiscovered May 31, 2018

Stated responseLaunched an investigation with an expert computer forensics firm

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov