HackingHealthcareHealthcareCustomer Data InvolvedDelayed DiscoveryPIIHighContained

Hillcrest Convalescent Center, Inc.

bd_9de93e16a266605e · schema v1 · pii pii-v1

Severity

High

Discovered

Feb 13, 2025

Filed

Mar 4, 2025

To disclose

19 days

Affected · nationwide

106,194340 in this filing

Linked

11 filings

Confidence

88%

Full breach record for Hillcrest Convalescent Center, Inc. →

Hillcrest Convalescent Center, Inc. (Durham, NC) reported an external system breach (hacking) that occurred on June 27, 2024, discovered on February 13, 2025. A total of 106,194 individuals were affected nationwide, including 340 Maine residents. Affected individuals were notified in writing on March 3, 2025, and offered 12 months of TransUnion credit monitoring at no charge.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Feb 13, 2025 → Filed with AG Mar 4, 202519d ✓ ME AG ≤30d19 days discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 231 days

discovery → filing · 19 days

Jun 27, 2024

Begins

Feb 13, 2025

Discovered

Mar 4, 2025

Filed

vs. sector median

10 wks faster

This filing is one of 11 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

Oregon State AGbd_450c36cd9e72a60b2025-03-04Verified
New Hampshire State AGbd_46c7f364f889c4ed2025-03-04Verified
Washington State AGbd_8323ca8f7ebddc142025-03-04Verified
California State AGbd_d9983a2b5a6a557c2025-03-04Verified

Show 6 more filings ↓up to 1d gap

HHS OCRbd_f2ba0b9c9e51c63f2025-03-04Verified by operator
Massachusetts State AGbd_f4d64e410a8e28d32025-03-05 · +1dVerified by operator
Maryland State AGbd_55a8a09648ffd05b2025-03-03 · +1dVerified
Montana State AGbd_8b96c2224b4c567a2025-03-03 · +1dVerified
Iowa State AGbd_98eabc481683cfdc2025-03-03 · +1dVerified
Indiana State AGbd_c8248abe92f311602025-03-03 · +1dVerified

Name: Hillcrest Convalescent Center, Inc.
norm: hillcrest convalescent center
Industry: Healthcare

Name: Hillcrest Convalescent Center, Inc.
norm: hillcrest convalescent center
Industry: Healthcare
Industry: Healthcarellm

Discovered: Feb 13, 2025
Breach occurred: Jun 27, 2024
Undetected for: 231 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 3, 2025
Affected individuals: 106,194state + nationwide
Data types: PII
Attack vector: Unauthorized Access
Threat actor: External

During the incident: Written notification sent to affected Maine residents on 03/03/2025
Identity theft protection services offered: 12 months; TransUnion; No charge access to Single Bureau Credit Monitoring/Single Bureau Credit Report/Single Bureau Credit Score
Changes made: 12 Months of TransUnion credit monitoring offered at no charge
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 19 days(19 days from discovery to filing)
Compliance flags: ME AG ≤30d · 19d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Feb 13, 2025
→ Filed with AG: Mar 4, 2025
19d 30 days ME AG ≤30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Feb 13, 2025 → Filed with AG: Mar 4, 2025	19d	30 days	ME AG ≤30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 11 states

View merged incident ↗

Maryland State AGMar 3 · first

Montana State AGMar 3 · first

Iowa State AGMar 3 · first

Indiana State AGMar 3 · first

Oregon State AG+1d

New Hampshire State AG+1d

Washington State AG+1d

California State AG+1d

HHS OCR+1d

Maine State AG+1d · this page

Massachusetts State AG+2d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/42bacd0b-8692-453a-ba7f-bc738761badc.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 4, 2025
Raw hash: 06aaf4cc0fb32e7a644f0e386f3f502ae6d78b9d23d807a696e3d7ac425b61e8

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entityHillcrest Convalescent Center, Inc.

Victim entityHillcrest Convalescent Center, Inc.

Incidentdiscovered Feb 13, 2025

Stated responseWritten notification sent to affected Maine residents on 03/03/2025

ComplianceME AG ≤30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov