Social EngineeringHealthcareHealthcarePhishingStolen CredentialsCustomer Data InvolvedEmployee Data InvolvedPHIIdentity (basic)Government IDHealth (basic)Financial accountMediumContained

BAYSTATE HEALTH, INC.

bd_abbaaee49c17c695 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 7, 2019

Filed

Apr 8, 2019

To disclose

9 weeks

Affected

1state residents only

Linked

3 filings

Confidence

66%

Full breach record for BAYSTATE HEALTH, INC. →4 incidents on file

Baystate Health notified the NH Attorney General of a phishing incident between Feb 7 and Mar 7, 2019, resulting in unauthorized access to employee email accounts. One New Hampshire resident's PHI, including name, address, DOB, SSN, Medicare number, and health information, was potentially exposed. Baystate secured accounts, engaged forensics, and offered credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 9 weeks / 60 days

Feb 7, 2019

Begins

Feb 7, 2019

Discovered

Apr 8, 2019

Filed

vs. sector median

3 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

HHS OCRbd_d91c1523d2b37e8f2019-04-05 · +3dVerified
Illinois State AGbd_a601a44e01784bd12019-01-01 · +97dCandidate

Name: BAYSTATE HEALTH, INC.
norm: baystate health

Name: BAYSTATE HEALTH, INC.
norm: baystate health
Industry: Healthcarellm

Discovered: Feb 7, 2019
Breach occurred: Feb 7, 2019 – Mar 7, 2019
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 5, 2019
Affected individuals: 1state-resident count only
Data types: PHIIdentity (basic)Government IDHealth (basic)Financial account
Data elements: Social Security numberDate of birthMedical information
Attack vector: Phishing
MITRE ATT&CK: T1566 PhishingT1078 Valid AccountsT1114 Email Collection
Threat actor: External
Regulator citations: Notified Office of the Attorney General of New Hampshire
Initial access: phishing_link

During the incident: Immediately secured each account
Began an investigation
Hired a leading computer forensic firm to assist
Mailing letters to the New Hampshire resident via U.S. mail
Offering a complimentary one-year membership in credit monitoring and identity theft protection services through Experian
Established a dedicated call center for patients to call with any questions
Changes made: Required a password change for all affected employees
Increased the level of email logging and is reviewing those logs regularly
Blocked access to email accounts outside of its network unless the access is approved by Baystate
Reinforcing employee training on how to detect and avoid phishing emails
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(60 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Illinois State AGJan 1 · first

HHS OCR+94d

New Hampshire State AG+97d · this page

Pattern: first filing Jan 1 (IL), last Apr 8 (NH) — a 97-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/baystate-health-20190408.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 8, 2019
Raw hash: 0b9f3905d7ce5c807d1ef10d33a647a950f669c585e2f4361097f88e08de8566

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityBAYSTATE HEALTH, INC.

Victim entityBAYSTATE HEALTH, INC.

Incidentdiscovered Feb 7, 2019

Stated responseImmediately secured each account

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov