HackingHealthcareHealthcareData ExfiltratedCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Government IDHealth (basic)PHIHighContained

Coös County Family Health

bd_baf9b9fa162a0aaa · schema v1 · pii pii-v1

Severity

High

Discovered

Jul 9, 2025

Filed

Oct 9, 2025

To disclose

13 weeks

Affected · nationwide

40,1851,222 in this filing

Linked

7 filings

Confidence

69%

Full breach record for Coös County Family Health →

Coos County Family Health Services, a New Hampshire non-profit healthcare provider, experienced an external system breach (hacking) on July 9, 2025. Unauthorized access to servers resulted in the potential viewing or copying of patient data, including names, DOBs, SSNs, and medical information. Approximately 40,185 individuals were affected, including 1,222 Maine residents. Notices were sent to Maine residents on October 9, 2025, offering 12 months of credit monitoring via TransUnion. Federal law enforcement, HHS, and credit bureaus were notified.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Jul 9, 2025 → Filed with AG Oct 9, 202592d ✗ ME AG >90d13 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 13 weeks / 92 days

Jul 9, 2025

Begins

Jul 9, 2025

Discovered

Oct 9, 2025

Filed

vs. sector median

+1 wks slower

This filing is one of 7 about the same incident.View merged incident

A leak claim by runsomewares about this victim predates this filing by 91 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Siterunsomewaresbd_b1954aa65bfd53992025-07-10 · +91dVerified

Regulatory filings (5) · sorted by filing gap

Vermont State AGbd_4157a034d7aa6a462025-10-09Verified by operator
Massachusetts State AGbd_bba4837ae5e628e12025-10-09Verified by operator
New Hampshire State AGbd_f14806bbae507beb2025-10-09Verified by operator
Illinois State AGbd_6092bef5a34d0ff62025-10-01 · +8dVerified by operator

Show 1 more filing ↓up to 34d gap

HHS OCRbd_8f8dbcd50604b6cb2025-09-05 · +34dCandidate

Name: Coös County Family Health
norm: coos county family health
Domain: coosfamilyhealth.org

Name: Coös County Family Health
norm: coos county family health
Domain: coosfamilyhealth.org
Industry: Healthcarellm

Discovered: Jul 9, 2025
Breach occurred: Jul 9, 2025
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 9, 2025
Affected individuals: 40,185state + nationwide
Data types: Identity (basic)Government IDHealth (basic)PHI
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Regulator citations: notified federal law enforcementproviding written notice of this incident to relevant state regulatorsnotified the three major credit reporting agencies, Equifax, Experian, and TransUnionnotified the U.S. Department of Health and Human Services
Initial access: exploit_public_facing

During the incident: Took steps to secure its systems
Conducted a thorough investigation
Notified federal law enforcement
Providing notified individuals with access to credit monitoring services for twelve (12) months, through TransUnion
Providing written notice of this incident to relevant state regulators
Notified the three major credit reporting agencies, Equifax, Experian, and TransUnion
Notified the U.S. Department of Health and Human Services
Changes made: Secured its systems
Conducted a thorough investigation
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 13 weeks(92 days from discovery to filing)
Compliance flags: ME AG >90d · 92dLeak >90dME CRA notice due
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Jul 9, 2025
→ Filed with AG: Oct 9, 2025
92d 90 days ME AG >90d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Jul 9, 2025 → Filed with AG: Oct 9, 2025	92d	90 days	ME AG >90d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 5 states

View merged incident ↗

HHS OCRSep 5 · first

Illinois State AG+26d

Vermont State AG+34d

Massachusetts State AG+34d

New Hampshire State AG+34d

Maine State AG+34d · this page

Pattern: first filing Sep 5 (NH), last Oct 9 (ME) — a 34-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/8a78e41b-2bf3-4afc-b10a-5079c8849885.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 9, 2025
Raw hash: b425915922098fbcfe61a27b68a54b29c4c291d980d988d6a076ced3d1527dfa

Linked disclosures

Ransomware claims (1)

Regulatory filings (5) · sorted by filing gap

Reporting entityCoös County Family Health

Victim entityCoös County Family Health

Incidentdiscovered Jul 9, 2025

Stated responseTook steps to secure its systems

ComplianceME AG >90d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov