HackingHealthcareHealthcareStolen CredentialsCustomer Data InvolvedTargetedPIIGovernment IDIdentity (basic)MediumContained

GATEWAY REHABILITATION CENTER

bd_9fb984e36d34b4a7 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 13, 2022

Filed

Nov 18, 2022

To disclose

23 weeks

Affected

8state residents only

Linked

6 filings

Confidence

66%

Full breach record for GATEWAY REHABILITATION CENTER →

Gateway Rehabilitation Center, a non-profit drug and alcohol rehabilitation provider, disclosed a data security incident discovered on June 13, 2022. The incident involved unauthorized access to systems, potentially compromising patient names and Social Security numbers. Eight New Hampshire residents were notified. The company engaged forensic experts, reported the incident to the FBI, and provided complimentary credit monitoring and identity protection services to affected individuals.

J jump to incidentP pin to compareR raw source

Leak gap clock⏱ Leak >90d23 weeks discovery → filing

Incident timeline

discovery → filing · 23 weeks / 158 days

Jun 13, 2022

Discovered

Jul 8, 2022

Scope determined

Nov 18, 2022

Filed

vs. sector median

+10 wks slower

This filing is one of 6 about the same incident.View merged incident

A leak claim by blackbyte about this victim predates this filing by 135 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Siteblackbytebd_f6493c4126c29b052022-07-06 · +135dVerified by operator

Regulatory filings (4) · sorted by filing gap

HHS OCRbd_05ee2fe15ab138202022-11-18Candidate
Indiana State AGbd_2f03d76418ec490d2022-11-18Verified
Maine State AGbd_b6bd6c502fbaca932022-11-18Verified by operator
Montana State AGbd_e1861cbb398ac64d2022-11-17 · +1dVerified by operator

Name: GATEWAY REHABILITATION CENTER
norm: gateway rehabilitation center

Name: GATEWAY REHABILITATION CENTER
norm: gateway rehabilitation center
Industry: Healthcarellm

Discovered: Jun 13, 2022
Materiality determined: Jul 8, 2022
Notification sent: Nov 18, 2022
Affected individuals: 8state-resident count only
Data types: PIIGovernment IDIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney GeneralReported incident to the Federal Bureau of Investigation
Initial access: valid_credentials

During the incident: Engaged independent digital forensics and incident response experts
Secured its network
Reported this incident to the Federal Bureau of Investigation
Established a toll-free call center through IDX
Providing complimentary credit monitoring and identity protection services
Changes made: Implemented additional safeguards to help ensure the security of its environment
Implemented measures to enhance the security of its digital environment
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 23 weeks(158 days from discovery to filing)
Compliance flags: Leak >90d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Montana State AGNov 17 · first

HHS OCR+1d

Indiana State AG+1d

Maine State AG+1d

New Hampshire State AG+1d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/gateway-rehabilitation-center-20221118.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 18, 2022
Raw hash: ee1587fedd31276bc998008418eac02c46f819ae143506c1f97b3e6ef85b2807

Linked disclosures

Ransomware claims (1)

Regulatory filings (4) · sorted by filing gap

Reporting entityGATEWAY REHABILITATION CENTER

Victim entityGATEWAY REHABILITATION CENTER

Incidentdiscovered Jun 13, 2022

Stated responseEngaged independent digital forensics and incident response experts

ComplianceLeak >90d

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov