HackingHealthcareHealthcareStolen CredentialsData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDMediumContained

Community First Medical Center

bd_954e9ae11e08da7d · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 28, 2023

Filed

Oct 4, 2023

To disclose

10 weeks

Affected

2state residents only

Linked

7 filings

Confidence

66%

Full breach record for Community First Medical Center →3 incidents on file

Community First Medical Center (CFMC) notified the NH AG of a data security incident where an unauthorized party accessed computer systems on or about July 12, 2023. CFMC discovered on July 28, 2023 that files containing personal information (including SSN, DOB, driver's license) were accessed. Approximately 2 NH residents were affected. CFMC engaged cybersecurity experts, offered credit monitoring, and sent notifications starting Sept 26, 2023.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 16 days

discovery → filing · 10 weeks / 68 days

Jul 12, 2023

Begins

Jul 28, 2023

Discovered

Oct 4, 2023

Filed

vs. sector median

3 wks faster

This filing is one of 7 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

Massachusetts State AGbd_27df2497febc7b932023-10-02 · +2dVerified
Montana State AGbd_ad780a314756fd242023-09-28 · +6dVerified
Indiana State AGbd_040c421436350c0e2023-09-26 · +8dCandidate
Maine State AGbd_3238f47bc41a61c22023-09-26 · +8dVerified

Show 2 more filings ↓up to 8d gap

HHS OCRbd_6fa159828caaaaa52023-09-26 · +8dCandidate
Vermont State AGbd_7e84fb60796976722023-09-26 · +8dVerified

Name: MCDONALD HOPKINS LLC
norm: mcdonald hopkins

Name: Community First Medical Center
norm: community first medical center
Industry: Healthcarellm

Discovered: Jul 28, 2023
Breach occurred: Jul 12, 2023
Undetected for: 16 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 26, 2023
Affected individuals: 2state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: External
Regulator citations: Notified New Hampshire Office of the Attorney General
Initial access: valid_credentials

During the incident: Commenced an immediate and thorough investigation
Engaged leading cybersecurity experts to identify what personal information, if any, might have been present in files potentially accessed by the unauthorized party
Offering the affected residents with a credit monitoring service
Providing the affected residents with written notification of this incident
Advising the affected residents about the process for placing fraud alerts and/or security freezes on their credit files
Changes made: Continually evaluates and modifies its practices and internal controls to enhance the security and privacy of personal information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 10 weeks(68 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 7 states

View merged incident ↗

Indiana State AGSep 26 · first

Maine State AGSep 26 · first

HHS OCRSep 26 · first

Vermont State AGSep 26 · first

Montana State AG+2d

Massachusetts State AG+6d

New Hampshire State AG+8d · this page

Pattern: first filing Sep 26 (IN), last Oct 4 (NH) — a 8-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/community-first-medical-center-20231004.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 4, 2023
Raw hash: 5aaec070d3dba1cd58d8572d2e8c881ce03c723f372a2439033ee779c8f50633

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityMCDONALD HOPKINS LLC

Victim entityCommunity First Medical Center

Incidentdiscovered Jul 28, 2023

Stated responseCommenced an immediate and thorough investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov