HackingHealthcareGovernment IDIdentity (basic)Health (basic)Financial accountMediumContained

Barlow Respiratory Hospital

bd_91adbcbf92f71c2c · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 27, 2021

Filed

Dec 30, 2021

To disclose

18 weeks

Affected

1state residents only

Linked

6 filings

Confidence

66%

Full breach record for Barlow Respiratory Hospital →

Barlow Respiratory Hospital notified the New Hampshire Attorney General of a data security incident affecting one NH resident. Unauthorized access occurred between August 21 and September 1, 2021. The actor exfiltrated files containing PII (SSN, DL) and PHI. Discovered August 27, 2021. Notification sent December 30, 2021.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 6 days

discovery → filing · 18 weeks / 125 days

Aug 21, 2021

Begins

Aug 27, 2021

Discovered

Dec 30, 2021

Filed

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitevicesocietybd_c0d804abf0c242bb2022-01-06 · +7dVerified by operator

Regulatory filings (4) · sorted by filing gap

Massachusetts State AGbd_69d8d7ae59ac02b02021-12-30Verified by operator
HHS OCRbd_aa1c857b3c9fefd02021-12-30Verified
California State AGbd_eee488eb88579f832021-12-30Verified
California State AGbd_c78d92e37fd7be232022-03-04 · +64dVerified by operator

Name: Barlow Respiratory Hospital
norm: barlow respiratory hospital

Name: Barlow Respiratory Hospital
norm: barlow respiratory hospital

Discovered: Aug 27, 2021
Breach occurred: Aug 21, 2021 – Sep 1, 2021
Undetected for: 6 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 30, 2021
Affected individuals: 1state-resident count only
Data types: Government IDIdentity (basic)Health (basic)Financial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
Threat actor: External
Initial access: valid_credentials

During the incident: Took steps to secure its systems
Launched an investigation with the assistance of a third-party forensic investigator
Notified law enforcement
Changes made: Implemented additional safeguards and technical security measures to further protect and monitor its systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 18 weeks(125 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 3 states

View merged incident ↗

Massachusetts State AGDec 30 · first

HHS OCRDec 30 · first

California State AGDec 30 · first

New Hampshire State AGDec 30 · first · this page

California State AG+64d

Pattern: first filing Dec 30 (MA), last Mar 4 (CA) — a 64-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/barlow-respiratory-hospital-20211230.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 30, 2021
Raw hash: 635e362c316f8074934ce0bce2c39db09912f504883d0566d5f25ece19fd3f47

Linked disclosures

Ransomware claims (1)

Regulatory filings (4) · sorted by filing gap

Reporting entityBarlow Respiratory Hospital

Victim entityBarlow Respiratory Hospital

Incidentdiscovered Aug 27, 2021

Stated responseTook steps to secure its systems

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov