HackingHealthcareHealthcareSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedGovernment IDIdentity (basic)MediumContained

Family Health Services MN d/b/a Entira Family Clinics

bd_b9620cab155eef1d · schema v1 · pii pii-v1

Severity

Medium

Discovered

Dec 4, 2020

Filed

Mar 4, 2021

To disclose

13 weeks

Affected

1state residents only

Linked

3 filings

Confidence

67%

Family Health Services MN (d/b/a Entira Family Clinics) notified the NH AG of a third-party cloud hosting vendor (Netgain) incident. Data including names and SSNs of 1 NH resident was accessed. Notification sent March 2, 2021. Credit monitoring offered.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 13 weeks / 90 days

Dec 4, 2020

Discovered

Mar 4, 2021

Filed

vs. sector median

+4 wks slower

This filing is one of 3 filings about the same incident.View merged incident

Part of Netgain Networks supply-chain incident (2021) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

HHS OCRbd_17e119fc6b69de812021-03-02 · +2dCandidate
Indiana State AGbd_19b2d9b39c4cc9f82021-03-02 · +2dCandidate

Name: Family Health Services MN d/b/a Entira Family Clinics
norm: family health services mn entira family clinics
Domain: entirafamilyclinics.com

Name: Family Health Services MN d/b/a Entira Family Clinics
norm: family health services mn entira family clinics
Domain: entirafamilyclinics.com
Also named: Family Health Services MNdba oflegal entity
Entira Family Clinicsdba oftrade name
Industry: Healthcarellm

Discovered: Dec 4, 2020
Materiality determined: —
Notification sent: Mar 2, 2021
Affected individuals: 1state-resident count only
Data types: Government IDIdentity (basic)
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain Compromise
Threat actor: External
Regulator citations: Notified New Hampshire Attorney General Consumer Protection Bureau
Third party: via Netgain Technology, Inc.
Initial access: supply_chain

During the incident: Engaged a law firm specializing in cybersecurity and data privacy to investigate further
Stayed in close communication with Netgain and its breach counsel regarding Netgain’s incident response and forensic investigation
Arranged for free credit monitoring services for all potentially affected individuals
Changes made: Reviewing and altering its policies and procedures relating to the security of its systems and servers
Reviewing its information life cycle management
Evaluating its continued use of Netgain hosting and cloud IT solutions
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 13 weeks(90 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

HHS OCRMar 2 · first

Indiana State AGMar 2 · first

New Hampshire State AG+2d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/family-health-services-20210304.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 4, 2021
Raw hash: 8772fd4a72901aa852ee48307c2c4389793be504538679fbc109961007851549

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityFamily Health Services MN d/b/a Entira Family Clinics

Victim entityFamily Health Services MN d/b/a Entira Family Clinics

Incidentdiscovered Dec 4, 2020

Stated responseEngaged a law firm specializing in cybersecurity and data privacy to investigate further

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov