MalwareHealthcareHealthcareMedusaRansom DemandedData ExfiltratedData EncryptedActor NamedCustomer Data InvolvedDelayed DiscoveryPIIIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTPHIHEALTH_BASICHighResolved
Woodfords Family Services
bd_aa00bf01723de54d · schema v1 · pii pii-v1
Full breach record for Woodfords Family Services →Woodfords Family Services (Maine healthcare provider) suffered a Medusa ransomware attack on April 8, 2024. Forensic investigation confirmed unauthorized access and data staging consistent with exfiltration. Impacted data: names, SSNs, driver's licenses, financial accounts, medical/health insurance info. 7,701 ME residents affected (41,984 total). PII scope determined January 29, 2026; notifications mailed March 27, 2026.
Leak gap clock✗ Leak >180d10 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
A leak claim by medusa about this victim predates this filing by 729 days.View originating leak claim
Source provenance
- Source URL
- https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/5986b328-7727-410c-bfb3-1e2c2d0a64dd.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Apr 7, 2026
- Raw hash
- fea25cb471fffe9e3000460c6d9362ae29f638619e490f5eff9a8662647fc792
Reporting entity
- Name
- Woodfords Family Services - Amended Notice Submissionnorm: woodfords family services amended notice submission
- Industry
- Healthcare
Victim entity
- Name
- Woodfords Family Servicesnorm: woodfords family
- Domain
- woodfords.org
- Industry
- Healthcare
- Industry
- Healthcarellm
Incident
- Discovered
- Jan 29, 2026
- Materiality determined
- Jan 29, 2026
- Notification sent
- Mar 27, 2026
- Affected individuals
- 7,701
- Data types
- PIIIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTPHIHEALTH_BASIC
- Attack vector
- Ransomware· Medusa
- MITRE ATT&CK
- T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 ChannelT1078 Valid Accounts
- Threat actor
- MedusaExternalFinancial
- Regulator citations
- Notified HHS Office for Civil Rights on June 3, 2024 (preliminary HIPAA notice)Notified Maine Office of Attorney General April 7, 2026 (amended notice)Notified three major credit reporting bureaus (Experian, Equifax, TransUnion)
Compliance
- Time to disclose
- 10 weeks(68 days from discovery to filing)
- Compliance flags
- Leak >180dME AG >30d · 68d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
- Clock breakdown
Statute Window Elapsed Threshold Status Maine Discovered: Jan 29, 2026→ Filed with AG: Apr 7, 202668d 30 days (soft) ME AG >30d
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.