HackingStolen CredentialsCapture Stored DataData ExfiltratedCustomer Data InvolvedBusiness Associate (HIPAA)Downstream VictimsIDENTITY_BASICIDENTITY_GOVERNMENTHEALTH_BASICFINANCIAL_ACCOUNTMediumActive
Zumpano Patricios, P.A.
bd_9c81cf321a6eb66d · schema v1 · pii pii-v1
Full breach record for Zumpano Patricios, P.A. →Zumpano Patricios, P.A. (ZP Law), a law firm acting as a business associate for healthcare providers, notified the NH AG of a cyber-attack intrusion detected on May 6, 2025. An unauthorized third party accessed and potentially exfiltrated files containing patient PII (SSN, DOB, names) and PHI. ZP Law changed passwords, blocked access, engaged forensic experts, and notified law enforcement. Two NH residents are affected. ZP Law is offering credit monitoring via IDX.
This filing is one of 3 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (2) · sorted by filing gap
- bd_f6cce678991d7afaHHS OCRfiled 2025-07-03Verified
- bd_7c11fa2a34694b4cIndiana State AGfiled 2025-07-11(8d gap)Verified
Source provenance
- Source URL
- https://mm.nh.gov/files/uploads/doj/remote-docs/zumpano-patricios-20250703.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jul 3, 2025
- Raw hash
- c048b32279c152bc26d0c7cc86c59db4b519d597b5797660730809f38f69ebb0
Reporting entity
- Name
- Zumpano Patricios, P.A.norm: zumpano patricios
Victim entity
- Name
- Zumpano Patricios, P.A.norm: zumpano patricios
Incident
- Discovered
- May 6, 2025
- Materiality determined
- —
- Notification sent
- Jul 3, 2025
- Affected individuals
- 2
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENTHEALTH_BASICFINANCIAL_ACCOUNT
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
- Threat actor
- ExternalFinancial
- Regulator citations
- Notified New Hampshire Attorney General
- Initial access
- valid_credentials
Compliance
- Time to disclose
- 8 weeks(58 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.