HackingHealthcareProfessional ServicesHealthcareStolen CredentialsData ExfiltratedCustomer Data InvolvedPIIFinancial accountLowContained

PCHP Medical Services Organization LLP

bd_91c120ff97a43b3f · schema v1 · pii pii-v1

Severity

Low

Discovered

Mar 24, 2024

Filed

Apr 26, 2024

To disclose

5 weeks

Affected

3state residents only

Linked

3 filings

Confidence

67%

Full breach record for PCHP Medical Services Organization LLP →

PCHP Medical Services Organization LLP notified the New Hampshire Attorney General on April 26, 2024, of a data security incident involving its payroll provider. The breach was discovered on March 24, 2024, when unusual activity was detected in the provider's online platform. The incident resulted in unauthorized access to payroll information for 3 New Hampshire residents. PCHP-MSO offered complimentary identity protection services and implemented additional security measures.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 5 weeks / 33 days

Mar 24, 2024

Discovered

Apr 26, 2024

Filed

vs. sector median

8 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Vermont State AGbd_60043c4973eefafc2024-04-26Candidate
Massachusetts State AGbd_ce2795a845c739192024-04-26Verified

Name: PCHP Medical Services Organization LLP
norm: pchp medical services organization

Name: PCHP Medical Services Organization LLP
norm: pchp medical services organization
Industry: HealthcarellmProfessional Servicesllm

Discovered: Mar 24, 2024
Materiality determined: —
Notification sent: Apr 26, 2024
Affected individuals: 3state-resident count only
Data types: PIIFinancial account
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain Compromise
Threat actor: External
Regulator citations: Notified Attorney General John Formella
Initial access: supply_chain

During the incident: Took steps to secure its payroll information with the assistance of the payroll provider
Investigated the incident and identified all individuals who could have had their personal information impacted
Offering complimentary credit and identity protection monitoring to all notified individuals
Changes made: Implementing additional security measures
Implementing additional technical security measures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(33 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Vermont State AGApr 26 · first

Massachusetts State AGApr 26 · first

New Hampshire State AGApr 26 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/pchp-medical-services-organization-20240426.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 26, 2024
Raw hash: d4d9983b42d7fb63fab4c12941e57a5146c20bcbd6db9801c3fd486f93af595e

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityPCHP Medical Services Organization LLP

Victim entityPCHP Medical Services Organization LLP

Incidentdiscovered Mar 24, 2024

Stated responseTook steps to secure its payroll information with the assistance of the payroll provider

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov