HackingHealthcareHealthcareData ExfiltratedCustomer Data InvolvedGovernment IDIdentity (basic)HighContained

Duncan Regional Hospital, Inc.

bd_9cf8dc6e97bedca7 · schema v1 · pii pii-v1

Severity

High

Discovered

Jan 22, 2022

Filed

Mar 3, 2022

To disclose

6 weeks

Affected · nationwide

92,3983 in this filing

Linked

8 filings

Confidence

66%

Full breach record for Duncan Regional Hospital, Inc. →2 incidents on file

Duncan Regional Hospital, Inc. reported an external system breach (hacking) occurring on January 16, 2022, discovered on January 22, 2022. The incident compromised the personal information of 92,398 individuals, including names and Social Security Numbers. The hospital notified affected individuals in writing on March 4, 2022, and provided 12 months of credit monitoring and identity theft protection services through Experian.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Jan 22, 2022 → Filed with AG Mar 3, 202240d ⏱ ME AG >30d6 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 6 days

discovery → filing · 6 weeks / 40 days

Jan 16, 2022

Begins

Jan 22, 2022

Discovered

Mar 3, 2022

Filed

vs. sector median

7 wks faster

This filing is one of 8 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (7) · sorted by filing gap

HHS OCRbd_379ce2137f1b8b8e2022-03-04 · +1dVerified
New Hampshire State AGbd_8e12f6dc142dcf3d2022-03-04 · +1dVerified
Maine State AGbd_951471bd831a875b2022-03-04 · +1dVerified
Indiana State AGbd_da7f54b2a4437b3e2022-03-04 · +1dVerified

Show 3 more filings ↓up to 61d gap

Montana State AGbd_e83433683660598a2022-03-04 · +1dVerified
Massachusetts State AGbd_0a4d100cea574cd72022-03-15 · +12dVerified
Illinois State AGbd_a382b9c075b77cac2022-01-01 · +61dCandidate

Name: Duncan Regional Hospital, Inc.
norm: duncan regional hospital

Name: Duncan Regional Hospital, Inc.
norm: duncan regional hospital
Industry: Healthcarellm

Discovered: Jan 22, 2022
Breach occurred: Jan 16, 2022
Undetected for: 6 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 4, 2022
Affected individuals: 92,398state + nationwide
Data types: Government IDIdentity (basic)
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: ExternalFinancial
Regulator citations: Filed data breach notice with Maine Attorney General
Initial access: exploit_public_facing

During the incident: Sent written notification to affected individuals
Offered 12 months of Experian IdentityWorks membership including credit monitoring, identity restoration, and up to $1 Million Identity Theft Insurance
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(40 days from discovery to filing)
Compliance flags: ME AG >30d · 40d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Jan 22, 2022
→ Filed with AG: Mar 3, 2022
40d 30 days (soft) ME AG >30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Jan 22, 2022 → Filed with AG: Mar 3, 2022	40d	30 days (soft)	ME AG >30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 7 states

View merged incident ↗

Illinois State AGJan 1 · first

Maine State AG+61d · this page

HHS OCR+62d

New Hampshire State AG+62d

Maine State AG+62d

Indiana State AG+62d

Montana State AG+62d

Massachusetts State AG+73d

Pattern: first filing Jan 1 (IL), last Mar 15 (MA) — a 73-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/05f9a679-6314-42f8-a099-b7954090c332.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 3, 2022
Raw hash: 3466ea70cea5a1a4be690b4ca3359710fb8cae46d148818f1c92ee5e4ade915c

Linked disclosures

Regulatory filings (7) · sorted by filing gap

Reporting entityDuncan Regional Hospital, Inc.

Victim entityDuncan Regional Hospital, Inc.

Incidentdiscovered Jan 22, 2022

Stated responseSent written notification to affected individuals

ComplianceME AG >30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov