HackingHealthcareTechnologyHealthcareStolen CredentialsCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Government IDHealth (basic)PHIMediumContained

MCG Health, LLC

bd_ab2f3099d15b3ab8 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 25, 2022

Filed

Jul 8, 2022

To disclose

15 weeks

Affected

5state residents only

Linked

11 filings

Confidence

67%

Full breach record for MCG Health, LLC →

MCG Health, LLC filed a supplemental notice with the NH AG regarding a data security incident affecting customers' patients/members. MCG determined on March 25, 2022 that an unauthorized party obtained personal info including SSNs, medical codes, and DOBs. This notice covers approximately 5 additional NH residents. MCG retained forensic investigators, coordinated with the FBI, and offers 2 years of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 15 weeks / 105 days

Mar 25, 2022

Discovered

Jul 8, 2022

Filed

vs. sector median

+2 wks slower

This filing is one of 11 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

Montana State AGbd_8779641a7cb24f1a2022-06-27 · +11dVerified
Maine State AGbd_a0380ae2d23fe3552022-06-21 · +17dVerified
Idaho State AGbd_a83f0caaa719a65b2022-06-13 · +25dVerified
Indiana State AGbd_04114e3688672cef2022-06-10 · +28dVerified

Show 6 more filings ↓up to 188d gap

HHS OCRbd_0a30370a2ec4495d2022-06-10 · +28dVerified
Montana State AGbd_345bdaa71a2ac5fb2022-06-10 · +28dVerified
Maine State AGbd_7b1a709405fc53f92022-06-10 · +28dVerified
Massachusetts State AGbd_b99d1929a95c95f92022-06-10 · +28dVerified
Illinois State AGbd_8cb2b43da00a45df2022-01-01 · +188dCandidate
Illinois State AGbd_9097fcbc166e7a792022-01-01 · +188dVerified

Name: MCG Health, LLC
norm: mcg health
Domain: mcg.com

Name: MCG Health, LLC
norm: mcg health
Domain: mcg.com
Industry: HealthcarellmTechnologyllm

Discovered: Mar 25, 2022
Materiality determined: —
Notification sent: Jun 10, 2022
Affected individuals: 5state-resident count only
Data types: Identity (basic)Government IDHealth (basic)PHI
Data elements: Social Security numberDate of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: MCG first notified the Office of the New Hampshire Attorney General about this issue on behalf of certain of its customers on June 10, 2022
Initial access: valid_credentials

During the incident: A leading forensic investigation firm was retained to assist in the investigation
MCG is coordinating with the FBI
Deployed additional monitoring tools
Continues to enhance the security of its systems
Changes made: Arranged to offer identity protection and credit monitoring services through Experian for two years at no cost
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 15 weeks(105 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 8 states

View merged incident ↗

Illinois State AGJan 1 · first

Indiana State AG+160d

HHS OCR+160d

Montana State AG+160d

Maine State AG+160d

Massachusetts State AG+160d

Idaho State AG+163d

Maine State AG+171d

Montana State AG+177d

New Hampshire State AG+188d · this page

Pattern: first filing Jan 1 (IL), last Jul 8 (NH) — a 188-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/mcg-health-20220708.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 8, 2022
Raw hash: c5a050178bf1db19dfa4e036d5a81a641ebb44163602ff938903e53ad0bb965c

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entityMCG Health, LLC

Victim entityMCG Health, LLC

Incidentdiscovered Mar 25, 2022

Stated responseA leading forensic investigation firm was retained to assist in the investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov