HackingHealthcareHealthcareData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDFinancial accountHealth (basic)PHIMediumContained

Heartland Health Center

bd_a5f51d90e496110e · schema v1 · pii pii-v2

Severity

Medium

Discovered

Feb 4, 2025

Filed

Oct 17, 2025

To disclose

—

Affected

Not disclosed

Linked

7 records

Confidence

66%

Full breach record for Heartland Health Center →3 incidents on file

Heartland Health Center notified Nebraska AG of a data incident discovered on February 4, 2025, where an unknown third party gained unauthorized access to its network. The breach exposed personal information including names, SSNs, DOBs, driver's license numbers, financial account numbers, and PHI (medical diagnoses, records, Medicare/Medicaid numbers). The organization engaged forensic consultants, secured systems, and is offering 12 months of credit monitoring via Cyberscout/TransUnion. Notices were sent on October 17, 2025.

J jump to incidentP pin to compareR raw source

Incident timeline

Feb 4, 2025

Discovered

Oct 17, 2025

Filed

This filing is one of 7 records about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitemedusabd_1ee456f0ab511bcc2025-02-24 · +234dVerified by operator

Regulatory filings (5) · sorted by filing gap

HHS OCRbd_5f6155b7de4c7d602025-10-17Verified
Indiana State AGbd_b8679ec8856a290a2025-10-17Verified by operator
Montana State AGbd_647209df288b0fc32025-10-21 · +4dVerified
Massachusetts State AGbd_b8d6da33aca4814b2025-10-21 · +4dVerified

Show 1 more filing ↓up to 4d gap

Vermont State AGbd_fba45e2f4449c4ea2025-10-21 · +4dVerified by operator

Name: Heartland Health Center
norm: heartland health center
Domain: heartlandhealthcenter.org

Name: Heartland Health Center
norm: heartland health center
Domain: heartlandhealthcenter.org
Industry: Healthcarellm

Discovered: Feb 4, 2025
Materiality determined: —
Notification sent: Oct 17, 2025
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDFinancial accountHealth (basic)PHI
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Initial access: exploit_public_facing

During the incident: Engaged the appropriate forensic consultants to investigate the root of the incident
Secure its systems
Securing the compromised systems
Initiating an investigation into the unauthorized access
Changes made: Utilized additional resources in an effort to assess the impact of the incident and better protect Heartland Health from future instances like this one
Continuously upgrading our already robust security measures
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 5 states

View merged incident ↗

HHS OCROct 17 · first

Indiana State AGOct 17 · first

Nebraska State AGOct 17 · first · this page

Montana State AG+4d

Massachusetts State AG+4d

Vermont State AG+4d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://nebraska.gov/ago/data-breach/documents/b61bc7a7-c99e-4a0f-b1d6-ed677567f85c.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 17, 2025
Raw hash: 892789d761ab7da9352438152b912ae62ea5f55cbb4f52f6071de6391c7bf782

Linked disclosures

Ransomware claims (1)

Regulatory filings (5) · sorted by filing gap

Reporting entityHeartland Health Center

Victim entityHeartland Health Center

Incidentdiscovered Feb 4, 2025

Stated responseEngaged the appropriate forensic consultants to investigate the root of the incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancenebraska.gov