HackingHealthcareHealthcareStolen CredentialsCustomer Data InvolvedPHIHealth (basic)Identity (basic)LowContained

Boulder Neurosurgical and Spine Associates

bd_a4f5395f3b6e8548 · schema v1 · pii pii-v1

Severity

Low

Discovered

Sep 21, 2021

Filed

Dec 2, 2021

To disclose

10 weeks

Affected

3state residents only

Linked

3 filings

Confidence

66%

Full breach record for Boulder Neurosurgical and Spine Associates →

Boulder Neurosurgical and Spine Associates detected unauthorized access to a business email account on September 21, 2021. The incident potentially exposed protected health information (PHI), including names, dates of birth, and medical records, for three New Hampshire residents. No evidence of specific data misuse was found. The organization engaged incident response experts, secured the account, notified affected patients and regulators, and offered 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 10 weeks / 72 days

Sep 21, 2021

Begins

Sep 21, 2021

Discovered

Dec 2, 2021

Filed

vs. sector median

2 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

HHS OCRbd_da518c6e8335a2af2021-11-29 · +3dVerified
Montana State AGbd_5c38e2e8db59427d2021-11-24 · +8dCandidate

Name: Boulder Neurosurgical and Spine Associates
norm: boulder neurosurgical and spine associates

Name: Boulder Neurosurgical and Spine Associates
norm: boulder neurosurgical and spine associates
Industry: Healthcarellm

Discovered: Sep 21, 2021
Breach occurred: Sep 21, 2021
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 24, 2021
Affected individuals: 3state-resident count only
Data types: PHIHealth (basic)Identity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: External
Regulator citations: Notified New Hampshire Attorney GeneralProvided notice to other state and federal regulators

During the incident: Engaged cybersecurity experts and a leading incident response team
Secured the subject email account
Launched an investigation to determine the nature and scope of the event
Mailed written notice to all of the clinic’s patients
Arranged to have IDX provide the affected consumers twelve (12) months of credit monitoring and identity restoration services
Provided notice to other state and federal regulators
Provided notice to multiple media outlets
Notified the three major credit reporting agencies (Equifax, TransUnion, Experian)
Changes made: Reviewed and enhanced data security policies and procedures
Providing additional training and education for staff
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 10 weeks(72 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Montana State AGNov 24 · first

HHS OCR+5d

New Hampshire State AG+8d · this page

Pattern: first filing Nov 24 (MT), last Dec 2 (NH) — a 8-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/boulder-neurosurgical-spine-20211201.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 2, 2021
Raw hash: 5a8721e134778f0fd803795c4b841653f5e43ad8866bccebaefc949d3de64b4d

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityBoulder Neurosurgical and Spine Associates

Victim entityBoulder Neurosurgical and Spine Associates

Incidentdiscovered Sep 21, 2021

Stated responseEngaged cybersecurity experts and a leading incident response team

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov