HackingHealthcareHealthcareCustomer Data InvolvedDelayed DiscoveryGovernment IDIdentity (basic)MediumContained

Public Health Management Corporation

bd_af10819349440b07 · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 8, 2023

Filed

Feb 26, 2024

To disclose

42 weeks

Affected

9state residents only

Linked

6 filings

Confidence

65%

Full breach record for Public Health Management Corporation →

Public Health Management Corporation (PHMC) notified the NH Attorney General on Feb 26, 2024, of unauthorized access to its network on May 8, 2023. PHMC became aware of suspicious activity on May 8, 2023, and launched an investigation with third-party forensic specialists. The investigation determined that an unauthorized actor had the ability to acquire information stored on the network during the period of access. A comprehensive review completed on Dec 20, 2023, identified 9 New Hampshire residents whose information, including Social Security numbers, was potentially impacted. PHMC is offering 12 months of credit monitoring through IDX.

J jump to incidentP pin to compareR raw source

Leak gap clock✗ Leak >180d42 weeks discovery → filing

Incident timeline

discovery → filing · 42 weeks / 294 days

May 8, 2023

Begins

May 8, 2023

Discovered

Feb 26, 2024

Filed

vs. sector median

+31 wks slower

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitetrigonabd_458f4399feee2dc12023-06-06 · +265dVerified

Regulatory filings (4) · sorted by filing gap

Massachusetts State AGbd_4d5237371c65bb8f2024-02-26Verified by operator
Vermont State AGbd_b5c251fb8a16298b2024-02-26Verified by operator
HHS OCRbd_dc8c3c91530aa0682023-07-06 · +235dCandidate
Presstrigonabd_1c563d0ea5f137252023-05-08 · +294dCandidate

Name: Public Health Management Corporation
norm: public health management
Domain: phmc.org

Name: Public Health Management Corporation
norm: public health management
Domain: phmc.org
Industry: Healthcarellm

Discovered: May 8, 2023
Breach occurred: May 8, 2023
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 26, 2024
Affected individuals: 9state-resident count only
Data types: Government IDIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified federal law enforcementProviding written notice of this incident to relevant state and federal regulators

During the incident: Launched an investigation with the assistance of third-party forensic specialists
Secured our network
Notified federal law enforcement regarding the event
Posted a notice of the event on the homepage of its website
Notified the media regarding the event
Providing individuals whose Social Security number was potentially affected by this incident access to credit monitoring services for 12 months, through IDX, at no cost to the individuals
Providing impacted individuals with guidance on how to better protect against identity theft and fraud
Providing individuals with information on how to place a fraud alert and security freeze on one’s credit file
Providing written notice of this incident to relevant state and federal regulators
Providing written notice of this incident to the three major credit reporting agencies, Equifax, Experian, and TransUnion
Changes made: Implemented additional safeguards related to data privacy and security
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 42 weeks(294 days from discovery to filing)
Compliance flags: Leak >180d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 4 states

View merged incident ↗

PressMay 8 · first

HHS OCR+59d

Massachusetts State AG+294d

Vermont State AG+294d

New Hampshire State AG+294d · this page

Pattern: first filing May 8, last Feb 26 (NH) — a 294-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/public-health-management-corporation-20240226.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 26, 2024
Raw hash: 9df187c68a304d42b3504e5ff11b542ef978088916e5f216df93dc3aad7823ca

Linked disclosures

Ransomware claims (1)

Regulatory filings (4) · sorted by filing gap

Reporting entityPublic Health Management Corporation

Victim entityPublic Health Management Corporation

Incidentdiscovered May 8, 2023

Stated responseLaunched an investigation with the assistance of third-party forensic specialists

ComplianceLeak >180d

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov