HackingHealthcareFinancial ServicesHealthcareStolen CredentialsRansomwareData ExfiltratedData EncryptedRansom DemandedCustomer Data InvolvedPIIIdentity (basic)Government IDMediumContained

Managed Care of North America, Inc.

bd_91f179da995e30ee · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 6, 2023

Filed

May 26, 2023

To disclose

12 weeks

Affected

644state residents only

Linked

11 filings

Confidence

66%

Full breach record for Managed Care of North America, Inc. →

Managed Care of North America, Inc. (MCNA) notified the NH AG of a data breach where unauthorized access occurred between Feb 26 and Mar 7, 2023. MCNA discovered the incident on Mar 6, 2023. Personal information of ~644 NH residents was accessed. MCNA engaged forensic investigators, contained the threat, and offered credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 8 days

discovery → filing · 12 weeks / 81 days

Feb 26, 2023

Begins

Mar 6, 2023

Discovered

May 26, 2023

Filed

vs. sector median

1 wks faster

This filing is one of 11 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

Oregon State AGbd_168ee69d767f341b2023-05-26Verified
Massachusetts State AGbd_462819dd00ab7cdb2023-05-26Verified
California State AGbd_85569ed740a38ff72023-05-26Verified
HHS OCRbd_8933bce90bcee00e2023-05-26Verified

Show 6 more filings ↓

South Carolina State AGbd_8e4e86427e58ac7c2023-05-26Verified
Washington State AGbd_bd79d24c6d422b052023-05-26Verified
Montana State AGbd_c6deca26eef879322023-05-26Verified
Maine State AGbd_d1e6071fa4c9eb842023-05-26Verified
Vermont State AGbd_d284c416d84338c32023-05-26Verified
Indiana State AGbd_fb79e2eeeef91f572023-05-26Verified

Name: Alston & Bird LLP
norm: alston bird

Name: Managed Care of North America, Inc.
norm: managed care of north america
Industry: HealthcarellmFinancial Servicesllm

Discovered: Mar 6, 2023
Breach occurred: Feb 26, 2023 – Mar 7, 2023
Undetected for: 8 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 26, 2023
Affected individuals: 644state-resident count only
Data types: PIIIdentity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1041 Exfiltration Over C2 ChannelT1486 Data Encrypted for Impact
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney General's Office
Initial access: valid_credentials

During the incident: Took immediate steps to contain the threat
Engaged a third-party forensic firm to investigate the incident and assist with remediation efforts
Conducted a comprehensive review of the impacted data
Sent written notifications to its impacted clients
Contacted law enforcement
Changes made: Enhanced its security and monitoring practices
Strengthened its systems to minimize the risk that a similar incident occurs in the future
Offered free credit monitoring services to New Hampshire residents
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 12 weeks(81 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 11 states

View merged incident ↗

Oregon State AGMay 26 · first

Massachusetts State AGMay 26 · first

California State AGMay 26 · first

HHS OCRMay 26 · first

South Carolina State AGMay 26 · first

Washington State AGMay 26 · first

Montana State AGMay 26 · first

Maine State AGMay 26 · first

Vermont State AGMay 26 · first

Indiana State AGMay 26 · first

New Hampshire State AGMay 26 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/managed-care-north-america-20230526.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 26, 2023
Raw hash: 14a17c30caba3bb282b1ceb7bb03d107410286c6f925828fab15ca0a3cbb04c6

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entityAlston & Bird LLP

Victim entityManaged Care of North America, Inc.

Incidentdiscovered Mar 6, 2023

Stated responseTook immediate steps to contain the threat

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov