HackingHealthcareHealthcareCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDHealth (basic)Financial accountCriticalContained

ANNA JAQUES HOSPITAL

bd_a2d1f21ff5fd6dad · schema v1 · pii pii-v1

Severity

Critical

Discovered

Dec 22, 2023

Filed

Dec 5, 2024

To disclose

50 weeks

Affected · nationwide

316,342637 in this filing

Linked

8 filings

Confidence

66%

Full breach record for ANNA JAQUES HOSPITAL →

Anna Jaques Hospital reported an external system breach (hacking) affecting 316,342 individuals, including 637 Maine residents. The breach occurred on December 25, 2023, and was discovered on December 22, 2023. Notification was sent on December 5, 2024. Affected data included names, government IDs, and health/financial info. Remediation included password resets and policy updates.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Dec 22, 2023 → Filed with AG Dec 5, 2024349d ✗ ME AG >90d50 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

Dec 25, 2023

Begins

Dec 5, 2024

Filed

vs. sector median

+39 wks slower

This filing is one of 8 about the same incident.View merged incident

A leak claim by moneymessage about this victim predates this filing by 320 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitemoneymessagebd_b79385a89ec65c172024-01-19 · +320dVerified

Regulatory filings (6) · sorted by filing gap

Massachusetts State AGbd_52cf0518f02a8f1b2024-12-05Verified by operator
Indiana State AGbd_70918698b29d68ce2024-12-05Verified
Vermont State AGbd_86baa33310a3dfbe2024-12-05Verified
New Hampshire State AGbd_339059c3c4b680752024-12-10 · +5dVerified by operator

Show 2 more filings ↓up to 346d gap

HHS OCRbd_33eb2e085be46f0f2024-02-20 · +289dVerified
Pressmoneymessagebd_6da1cded0badab372023-12-25 · +346dCandidate

Name: ANNA JAQUES HOSPITAL
norm: anna jaques hospital
Industry: Healthcare

Name: ANNA JAQUES HOSPITAL
norm: anna jaques hospital
Industry: Healthcare
Industry: Healthcarellm

Discovered: Dec 22, 2023
Breach occurred: Dec 25, 2023
Materiality determined: —
Notification sent: Dec 5, 2024
Affected individuals: 316,342state + nationwide
Data types: Identity (basic)Government IDHealth (basic)Financial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Filed notice with Maine Attorney General
Initial access: exploit_public_facing

During the incident: Reset passwords
Updated information security policies
Continually evaluate and modify practices and internal controls
Set up external dedicated call center
Changes made: Updated information security policies
Continually evaluate and modify practices and internal controls to enhance security and privacy
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 50 weeks(349 days from discovery to filing)
Compliance flags: ME AG >90d · 349dME resident >180d · 349dLeak >180d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Dec 22, 2023
→ Filed with AG: Dec 5, 2024
349d 90 days ME AG >90d
Maine
Discovered: Dec 22, 2023
→ Notified: Dec 5, 2024
349d 180 days ME resident >180d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Dec 22, 2023 → Filed with AG: Dec 5, 2024	349d	90 days	ME AG >90d
Maine	Discovered: Dec 22, 2023 → Notified: Dec 5, 2024	349d	180 days	ME resident >180d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 5 states

View merged incident ↗

PressDec 25 · first

HHS OCR+57d

Massachusetts State AG+346d

Indiana State AG+346d

Vermont State AG+346d

Maine State AG+346d · this page

New Hampshire State AG+351d

Pattern: first filing Dec 25, last Dec 10 (NH) — a 351-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/ecfcfbba-9bcf-4909-ab3b-2cd996e79cfa.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 5, 2024
Raw hash: 9d42dcf96ec6720cc56755fe41fa559124fdda5a48135d981633feec69295168

Linked disclosures

Ransomware claims (1)

Regulatory filings (6) · sorted by filing gap

Reporting entityANNA JAQUES HOSPITAL

Victim entityANNA JAQUES HOSPITAL

Incidentdiscovered Dec 22, 2023

Stated responseReset passwords

ComplianceME AG >90d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov