Social EngineeringHealthcareTechnologyHealthcarePhishingStolen CredentialsCustomer Data InvolvedMulti-Stage ChainPIIIdentity (basic)LowContained

Access TeleCare

bd_a685c2b56520cb69 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jan 8, 2024

Filed

Dec 23, 2024

To disclose

50 weeks

Affected

55state residents only

Linked

6 filings

Confidence

65%

Full breach record for Access TeleCare →2 incidents on file

Access TeleCare notified New Hampshire AG of a data event affecting 55 residents. Suspicious activity on an employee email account was discovered on Jan 8, 2024. Unauthorized access occurred between Nov 6, 2023 and Jan 8, 2024. Personal information was potentially accessed. Access TeleCare disabled the account, engaged forensic specialists, and provided credit monitoring services.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 63 days

discovery → filing · 50 weeks / 350 days

Nov 6, 2023

Begins

Jan 8, 2024

Discovered

Aug 30, 2024

Scope determined

Dec 23, 2024

Filed

vs. sector median

+39 wks slower

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

California State AGbd_68966e9e1dda38fb2024-12-23Candidate
Vermont State AGbd_7386e5a0fcb6fa662024-12-23Verified
Massachusetts State AGbd_9f4064c0bceede442024-12-23Verified
California State AGbd_89d95e54e9a9677a2025-03-14 · +81dVerified

Show 1 more filing ↓up to 81d gap

Vermont State AGbd_98e39108670c7a632025-03-14 · +81dVerified

Name: Access TeleCare
norm: access telecare

Name: Access TeleCare
norm: access telecare
Industry: HealthcarellmTechnologyllm

Discovered: Jan 8, 2024
Breach occurred: Nov 6, 2023 – Jan 8, 2024
Undetected for: 63 daysoccurrence → discovery
Materiality determined: Aug 30, 2024
Notification sent: Dec 23, 2024
Affected individuals: 55state-resident count only
Data types: PIIIdentity (basic)
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified the U.S. Department of Health and Human ServicesNotified prominent media pursuant to HIPAAProvided written notice to relevant state and federal regulatorsNotified the three major credit reporting agencies, Equifax, Experian, and TransUnion
Initial access: phishing_link

During the incident: Disabled the account
Initiated an investigation into the nature and scope of the event with the assistance of third-party forensic specialists
Engaged a data review vendor to conduct a comprehensive and time-intensive review of the contents of the email accounts
Engaged in additional work to review and verify the affected information, locate address information for the potentially impacted individuals, and issue notifications
Providing access to credit monitoring services for , through TransUnion to individuals whose personal information was potentially affected by this incident
Providing impacted individuals with guidance on how to better protect against identity theft and fraud
Providing written notice of this incident to relevant state and federal regulators, as necessary, and to the three major credit reporting agencies, Equifax, Experian, and TransUnion
Notifying the U.S. Department of Health and Human Services and prominent media pursuant to the Health Insurance Portability and Accountability Act (HIPAA)
Changes made: Implemented additional safeguards and training to its employees
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 50 weeks(350 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 4 states

View merged incident ↗

California State AGDec 23 · first

Vermont State AGDec 23 · first

Massachusetts State AGDec 23 · first

New Hampshire State AGDec 23 · first · this page

California State AG+81d

Vermont State AG+81d

Pattern: first filing Dec 23 (CA), last Mar 14 (VT) — a 81-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/access-telecare-20241223.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 23, 2024
Raw hash: ce057fdb3f7615b8f6376d594bb3032305cc2ad43e24f6b6a547f5768bc35907

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityAccess TeleCare

Victim entityAccess TeleCare

Incidentdiscovered Jan 8, 2024

Stated responseDisabled the account

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov