OHIOHackingHealthcareHealthcareCustomer Data InvolvedIdentity (basic)Government IDHealth (basic)HighResolved

Greater Cincinnati Behavioral Health

bd_a0db490ef29f1fdb · schema v1 · pii pii-v1

Severity

High

Discovered

Dec 10, 2023

Filed

Feb 2, 2024

To disclose

—

Affected

50,000

Linked

6 filings

Confidence

95%

Full breach record for Greater Cincinnati Behavioral Health →

Greater Cincinnati Behavioral Health Services (OH) reported to HHS on 2024-02-02 a Hacking/IT Incident affecting 50,000 individuals (60,796 per the web description). Breached information located on a Network Server. PHI involved included names, addresses, dates of birth, Social Security numbers, diagnoses, conditions, lab results, medications, and other treatment information. The CE notified affected individuals, the media, and HHS, and implemented additional administrative, technical, and security safeguards.

J jump to incidentP pin to compareR raw source

Leak gap clock⏱ Leak >30d

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

discovery → filing · 8 weeks / 54 days

Dec 10, 2023

Discovered

Feb 2, 2024

Filed

This filing is one of 6 about the same incident.View merged incident

A leak claim by dragonforce about this victim predates this filing by 51 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitedragonforcebd_41132c496638b1b92023-12-13 · +51dVerified

Regulatory filings (4) · sorted by filing gap

Indiana State AGbd_f65e62cc431b5ba12024-01-25 · +8dVerified
Maine State AGbd_94597d00252f31112024-06-13 · +132dVerified by operator
Massachusetts State AGbd_fadf7304fea6e46e2024-06-13 · +132dVerified by operator
Maine State AGbd_af604ff30818615e2024-09-11 · +222dVerified by operator

Name: Greater Cincinnati Behavioral Health
norm: greater cincinnati behavioral health
Domain: gcbhs.com
Industry: Health Care Services

Name: Greater Cincinnati Behavioral Health
norm: greater cincinnati behavioral health
Domain: gcbhs.com
Industry: Health Care Services
Industry: Healthcaresource default

Discovered: Dec 10, 2023
Materiality determined: —
Notification sent: —
Affected individuals: 50,000nationwide
Data types: Identity (basic)Government IDHealth (basic)
HHS breach type: Hacking / IT incident
Where the data lived: Network server
Covered-entity type: Healthcare provider
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified HHS

During the incident: Notified affected individuals
Notified the media
Notified HHS
Implemented additional administrative, technical, and security safeguards
Changes made: Additional administrative safeguards implemented
Additional technical safeguards implemented
Additional security safeguards implemented
Source: Quoted from the filing itself, not independently verified.

Compliance flags: Leak >30dHHS report on timeHHS notified
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: Dec 10, 2023
→ Notified: not extracted
— 60 days HHS report on time
HIPAA
Discovered: Dec 10, 2023
→ Notified: not extracted
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: Dec 10, 2023 → Notified: not extracted	—	60 days	HHS report on time
HIPAA	Discovered: Dec 10, 2023 → Notified: not extracted	—	regulatory submission	HHS notified

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 4 states

View merged incident ↗

Indiana State AGJan 25 · first

HHS OCR+8d · this page

Maine State AG+140d

Massachusetts State AG+140d

Maine State AG+230d

Pattern: first filing Jan 25 (IN), last Sep 11 (ME) — a 230-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Feb 2, 2024
Raw hash: c89e0a71bf3e6c68b2ba8d81eacfe061a8cbd4552cea59b926b67f65f1d46e17

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html1.5 KB

Download View at source

Linked disclosures

Ransomware claims (1)

Regulatory filings (4) · sorted by filing gap

Reporting entityGreater Cincinnati Behavioral Health

Victim entityGreater Cincinnati Behavioral Health

Incidentdiscovered Dec 10, 2023

Stated responseNotified affected individuals

ComplianceLeak >30d

Extraction provenanceno artifact recorded

Source provenanceocrportal.hhs.gov

Source filing