DisclosureLens
HackingHealthcareHealthcareStolen CredentialsCustomer Data InvolvedDelayed DiscoveryPHIHealth (basic)Identity (basic)Financial accountLowContained

Lexington Medical Center

bd_b4dad9ce2b4c1bee · schema v1 · pii pii-v1

Severity

Low

Discovered

Oct 4, 2023

Filed

Feb 14, 2024

To disclose

19 weeks

Affected

Not disclosed

Linked

2 filings

Confidence

66%

Lexington Medical Center notified consumers that an unauthorized party accessed an employee email account and data drive on October 4, 2023. The organization detected the activity immediately and contained the incident. A forensic investigation concluded on January 18, 2024, that billing-related documents containing names, dates of birth, medical record numbers, and health insurance IDs may have been accessed. Social Security numbers and electronic medical records were not accessed. The breach affected residents of Maryland and North Carolina.

Vermont clock✗ VT AG >45 bday19 weeks discovery → filing

Incident timeline

discovery → filing · 19 weeks / 133 days

Oct 4, 2023

Begins

Oct 4, 2023

Discovered

Feb 14, 2024

Filed

vs. sector median

+6 wks slower

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Filing propagation · 2 filings · 2 states

View merged incident ↗
Vermont State AGFeb 14 · first · this page
South Carolina State AG+6d

Pattern: first filing Feb 14 (VT), last Feb 20 (SC) — a 6-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.