HackingHealthcareHealthcareData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDHealth (basic)MediumActive

Dermatology Associates of Concord

bd_a9b34c46de463ac2 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 19, 2025

Filed

Dec 2, 2025

To disclose

11 weeks

Affected

17state residents only

Linked

4 filings

Confidence

66%

Full breach record for Dermatology Associates of Concord →2 incidents on file

Dermatology Associates of Concord (DAC) notified the New Hampshire Attorney General of a data event affecting 17 NH residents. Unauthorized access occurred between Sept 18-19, 2025, involving copying of files containing names, SSNs, driver's licenses, passports, and medical info. DAC engaged third-party cybersecurity experts, notified law enforcement, and provided 2 years of TransUnion credit monitoring. Investigation is ongoing.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 1 days

discovery → filing · 11 weeks / 74 days

Sep 18, 2025

Begins

Sep 19, 2025

Discovered

Dec 2, 2025

Filed

vs. sector median

2 wks faster

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Vermont State AGbd_93f5f48750caf83e2025-12-02Verified
Massachusetts State AGbd_4d2d7a0478cee5482025-11-18 · +14dVerified
HHS OCRbd_5931d75d9958c2d22025-11-18 · +14dVerified

Name: Mullen Coughlin LLC
norm: mullen coughlin

Name: Dermatology Associates of Concord
norm: dermatology associates of concord
Industry: healthcare
Industry: Healthcarellm

Discovered: Sep 19, 2025
Breach occurred: Sep 18, 2025 – Sep 19, 2025
Undetected for: 1 dayoccurrence → discovery
Materiality determined: —
Notification sent: Nov 18, 2025
Affected individuals: 17state-resident count only
Data types: Identity (basic)Government IDHealth (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: notified federal law enforcement regarding the eventproviding written notice of this incident to relevant state and federal regulators, as necessary, including the U.S. Department of Health and Human Services
Initial access: valid_credentials

During the incident: Launched an investigation with the help of third-party cybersecurity experts
Notified federal law enforcement regarding the event
Providing access to credit monitoring services for two (2) years, through TransUnion
Providing impacted individuals with guidance on how to better protect against identity theft and fraud
Providing written notice of this incident to relevant state and federal regulators
Changes made: Enhanced its existing security protocols
Continues to evaluate its policies and procedures related to data privacy and security
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 11 weeks(74 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 3 states

View merged incident ↗

Massachusetts State AGNov 18 · first

HHS OCRNov 18 · first

Vermont State AG+14d

New Hampshire State AG+14d · this page

Pattern: first filing Nov 18 (MA), last Dec 2 (NH) — a 14-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/dermatology-associates-concord-20251202.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 2, 2025
Raw hash: 12f7319e21e58b2d5355f9a37e82b7afd03fe9c15221dfa7f36edcf6ee6e09b8

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityMullen Coughlin LLC

Victim entityDermatology Associates of Concord

Incidentdiscovered Sep 19, 2025

Stated responseLaunched an investigation with the help of third-party cybersecurity experts

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov