MisuseHealthcareProfessional ServicesHealthcareData MishandlingCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDFinancialMediumActive

Phoenix House Foundation, Inc. and its affiliates

bd_a31f26cc4baadc4c · schema v1 · pii pii-v1

Severity

Medium

Discovered

Dec 22, 2014

Filed

Feb 5, 2015

To disclose

6 weeks

Affected

91state residents only

Linked

3 filings

Confidence

66%

Full breach record for Phoenix House Foundation, Inc. and its affiliates →

Phoenix House Foundation, Inc. notified the NH Attorney General of a breach involving unauthorized changes to its electronic payroll system by a third-party consultant. The incident, discovered on Dec 22, 2014, affected 91 NH residents, exposing names, SSNs, addresses, salary, and benefit info. Phoenix House terminated the consultant, notified law enforcement, and offered 1 year of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 3 days

discovery → filing · 6 weeks / 45 days

Dec 19, 2014

Begins

Dec 22, 2014

Discovered

Feb 5, 2015

Filed

vs. sector median

6 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

California State AGbd_348fb33d632cb30e2015-02-05Candidate
Massachusetts State AGbd_36ae74a84ff62e1e2015-02-06 · +1dVerified

Name: BAKER & HOSTETLER LLP
norm: baker hostetler

Name: Phoenix House Foundation, Inc. and its affiliates
norm: phoenix house foundation inc and its affiliates
Industry: HealthcarellmProfessional Servicesllm

Discovered: Dec 22, 2014
Breach occurred: Dec 19, 2014
Undetected for: 3 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 5, 2015
Affected individuals: 91state-resident count only
Data types: Identity (basic)Government IDFinancial
Data elements: Social Security number
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: Partner
Regulator citations: Notified Office of the Attorney General, New Hampshire
Initial access: trusted_relationship

During the incident: Removed the consultant’s access to the systems at issue
Conducted an investigation to determine what information may have been changed
Terminated the consultant’s contract
Reported the incident to law enforcement
Cooperating with law enforcement in its investigation of this incident
Offering one year of complimentary credit monitoring and identity theft protection services through Experian
Providing call center support for those affected
Changes made: Conducting a comprehensive review of our information security practices and procedures
Working to restore the information to its state before the incident
Updating the files for authorized changes that have occurred since the incident
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(45 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

California State AGFeb 5 · first

New Hampshire State AGFeb 5 · first · this page

Massachusetts State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/phoenix-house-foundation-20150205.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 5, 2015
Raw hash: 070f87b3642729dd65197163975961e9ee67eee0d731e7ca19ff65dbcda58475

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityBAKER & HOSTETLER LLP

Victim entityPhoenix House Foundation, Inc. and its affiliates

Incidentdiscovered Dec 22, 2014

Stated responseRemoved the consultant’s access to the systems at issue

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov