HackingHealthcareTechnologyHealthcareCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Government IDFinancial accountPHIMediumContained

NuLife Med, LLC

bd_b3ea59a3cdd5c424 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 11, 2022

Filed

Dec 23, 2022

To disclose

41 weeks

Affected

339state residents only

Linked

9 filings

Confidence

66%

Full breach record for NuLife Med, LLC →

NuLife Med, LLC notified the NH Attorney General of a data event affecting 339 NH residents. Unauthorized access occurred March 9-11, 2022, discovered March 11, 2022. Data included names, SSNs, financial accounts, driver's licenses, and PHI. NuLife engaged forensic specialists, notified law enforcement, and provided 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Leak gap clock✗ Leak >180d41 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 2 days

discovery → filing · 41 weeks / 287 days

Mar 9, 2022

Begins

Mar 11, 2022

Discovered

Dec 23, 2022

Filed

vs. sector median

+28 wks slower

This filing is one of 9 about the same incident.View merged incident

A leak claim by vicesociety about this victim predates this filing by 250 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitevicesocietybd_de29c5de1c1817a52022-04-17 · +250dVerified by operator

Regulatory filings (7) · sorted by filing gap

Maine State AGbd_0002cdbd552975b02022-12-19 · +4dVerified
Indiana State AGbd_5c426d01313db7e72022-12-19 · +4dVerified
Massachusetts State AGbd_81428d6a938c16cb2022-12-19 · +4dVerified
HHS OCRbd_b351e41ae4dcf1652022-07-25 · +151dVerified

Show 3 more filings ↓up to 356d gap

HHS OCRbd_35172ce5064522ee2022-05-09 · +228dVerified
Montana State AGbd_83c44d098a1f145a2022-05-09 · +228dVerified
Illinois State AGbd_18e600dce3db2d8e2022-01-01 · +356dCandidate

Name: NuLife Med, LLC
norm: nulife med

Name: NuLife Med, LLC
norm: nulife med
Industry: HealthcarellmTechnologyllm

Discovered: Mar 11, 2022
Breach occurred: Mar 9, 2022 – Mar 11, 2022
Undetected for: 2 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 19, 2022
Affected individuals: 339state-resident count only
Data types: Identity (basic)Government IDFinancial accountPHI
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: Notified the Office of the New Hampshire Attorney GeneralNotifying the U.S. Department of Health and Human ServicesNotifying the three major credit reporting agencies, Equifax, Experian, and TransUnion

During the incident: Launched an investigation, aided by third-party forensic specialists
Notified federal law enforcement
Provided written notice to affected individuals
Posted notification on their website
Provided notification to prominent media where required under HIPAA
Conducted a review of the data that was potentially impacted, with the assistance of third-party subject matter specialists
Provided access to credit monitoring services for 12 months through TransUnion
Changes made: Working to implement additional safeguards and training to its employees
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 41 weeks(287 days from discovery to filing)
Compliance flags: Leak >180d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 6 states

View merged incident ↗

Illinois State AGJan 1 · first

HHS OCR+128d

Montana State AG+128d

HHS OCR+205d

Maine State AG+352d

Indiana State AG+352d

Massachusetts State AG+352d

New Hampshire State AG+356d · this page

Pattern: first filing Jan 1 (IL), last Dec 23 (NH) — a 356-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/nulife-med-20221223.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 23, 2022
Raw hash: 07630ad439624e2f80fc77c92717e8944b82229b0db082ded34aeddceb458345

Linked disclosures

Ransomware claims (1)

Regulatory filings (7) · sorted by filing gap

Reporting entityNuLife Med, LLC

Victim entityNuLife Med, LLC

Incidentdiscovered Mar 11, 2022

Stated responseLaunched an investigation, aided by third-party forensic specialists

ComplianceLeak >180d

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov