HackingHealthcareProfessional ServicesHealthcareData ExfiltratedCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Government IDFinancial accountHealth (basic)PHIHighActive

Comstar LLC

bd_b57b40825eebd8b3 · schema v1 · pii pii-v1

Severity

High

Discovered

Mar 26, 2022

Filed

Aug 26, 2022

To disclose

22 weeks

Affected

90,756state residents only

Linked

13 filings

Confidence

67%

Full breach record for Comstar LLC →

Comstar LLC, an ambulance billing service, reported a data event discovered on March 26, 2022, involving unauthorized access to servers. The incident potentially exposed PHI, SSNs, driver's licenses, and financial data of 90,756 New Hampshire residents. Comstar engaged third-party experts, notified law enforcement, and provided 12 months of credit monitoring. This filing is a second supplemental notice dated August 22, 2022.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 22 weeks / 153 days

Mar 26, 2022

Discovered

Aug 26, 2022

Filed

vs. sector median

+10 wks slower

This filing is one of 13 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

Maine State AGbd_1a59883a0195e6ff2022-08-22 · +4dVerified
California State AGbd_464f9d9da319c0212022-08-22 · +4dVerified
Maine State AGbd_b95db5904d98be342022-06-30 · +57dVerified
California State AGbd_d818ee99f86b12dd2022-06-30 · +57dVerified

Show 6 more filings ↓up to 1008d gap

California State AGbd_85177613717390c12022-06-14 · +73dVerified
New Hampshire State AGbd_0db5d3b9a664394c2022-05-27 · +91dVerified
HHS OCRbd_7c3a134ab345e7362022-05-26 · +92dVerified
Indiana State AGbd_662700170b2a610b2022-05-25 · +93dVerified
Montana State AGbd_7e62f29ad917b45d2022-05-25 · +93dVerified
HHS OCR enforcementbd_431a2323ea15d5c32025-05-30 · +1008dVerified by operator

Showing first 10 of 12 linked disclosures.

Name: Comstar Technologies, LLC
norm: comstar technologies

Name: Comstar LLC
norm: comstar
Industry: HealthcarellmProfessional Servicesllm

Discovered: Mar 26, 2022
Materiality determined: —
Notification sent: May 23, 2022
Affected individuals: 90,756state-resident count only
Data types: Identity (basic)Government IDFinancial accountHealth (basic)PHI
Data elements: Social Security numberDate of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: Notified federal law enforcementProviding written notice to relevant state regulatorsNotifying the US. Department of Health and Human Services

During the incident: Took steps to secure their network
Launched a thorough investigation with the assistance of third-party experts
Notified federal law enforcement
Provided access to credit monitoring services for at least twelve (12) months through Equifax
Posted notice of this incident on its website
Issued a press release
Provided written notice to relevant state regulators and the three major credit reporting agencies
Notifying the US. Department of Health and Human Services
Changes made: Working to implement additional safeguards and training to its employees
Reviewing policies and procedures to further protect against similar incidents moving forward
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 22 weeks(153 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 6 states

View merged incident ↗

Indiana State AGMay 25 · first

Montana State AGMay 25 · first

HHS OCR+1d

New Hampshire State AG+2d

California State AG+20d

Maine State AG+36d

California State AG+36d

Maine State AG+89d

California State AG+89d

New Hampshire State AG+93d · this page

HHS OCR enforcement+1101d

Pattern: first filing May 25 (IN), last May 30 — a 1101-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Cascade drawn from the first 10 linked disclosures of 12 — the full spread may be wider.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/comstar-20220826.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 26, 2022
Raw hash: 15bbc61e4a752dcbe29e3aab51dbfef066edd0907fb94e6e6f53412d14c990b0

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entityComstar Technologies, LLC

Victim entityComstar LLC

Incidentdiscovered Mar 26, 2022

Stated responseTook steps to secure their network

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov