MalwareHealthcareHealthcareRansomwareData ExfiltratedData EncryptedRansom DemandedRansom PaidCustomer Data InvolvedSupply Chain (3P Vendor)PHIHealth (basic)Government IDIdentity (basic)MediumContained

NEIGHBORHOOD HEALTHCARE

bd_bb6f3e4aec00ab00 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Dec 3, 2020

Filed

Apr 9, 2021

To disclose

18 weeks

Affected

1state residents only

Linked

5 filings

Confidence

66%

Full breach record for NEIGHBORHOOD HEALTHCARE →3 incidents on file

Neighborhood Healthcare, a healthcare provider, notified the New Hampshire Attorney General of a data breach involving its third-party hosting provider, Netgain Technology, LLC. Netgain experienced unauthorized access starting November 24, 2020, followed by a ransomware attack on December 3, 2020, which encrypted files and disrupted operations. The breach potentially exposed patient PHI, names, DOBs, addresses, and SSNs of 1 New Hampshire resident. Netgain paid a ransom to the attacker. Neighborhood Healthcare notified the affected individual on April 8, 2021, offering credit monitoring and identity protection services.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 9 days

discovery → filing · 18 weeks / 127 days

Nov 24, 2020

Begins

Dec 3, 2020

Discovered

Apr 9, 2021

Filed

vs. sector median

+6 wks slower

This filing is one of 5 about the same incident.View merged incident

Part of Netgain Networks supply-chain incident (2021) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Montana State AGbd_2ef8bb246b7050442021-04-08 · +1dCandidate
California State AGbd_8aaf06ac833493f32021-04-08 · +1dCandidate
Indiana State AGbd_b955947cb8fc4eec2021-04-08 · +1dVerified
HHS OCRbd_57b894cf856fcd162021-04-14 · +5dVerified

Name: Bryan Cave Leighton Paisner LLP
norm: bryan cave leighton paisner

Name: NEIGHBORHOOD HEALTHCARE
norm: neighborhood healthcare
Industry: Healthcarellm

Discovered: Dec 3, 2020
Breach occurred: Nov 24, 2020
Undetected for: 9 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 8, 2021
Affected individuals: 1state-resident count only
Data types: PHIHealth (basic)Government IDIdentity (basic)
Data elements: Social Security numberDate of birth
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney General's Office
Third party: via Netgain Technology, LLC
Initial access: external_remote_services

During the incident: Netgain took additional measures to contain the threat and address the issue
Netgain’s technical teams worked closely with third-party experts to remove the threat in the impacted environments and confirm that client and internal systems are protected
Neighborhood Healthcare has worked to review those records, to identify individuals impacted, conduct an investigation into the incident with the assistance outside experts, and to transmit letters to impacted individuals with its accompanying protective measures
Neighborhood Healthcare transitioned to a new hosting provider
Netgain paid a significant amount to the attacker in exchange for assurances that the attacker will delete all copies of this data and that it will not publish, sell, or otherwise disclose the data
Netgain’s cybersecurity experts conducted regular dark web scans for the impacted files
Changes made: Netgain strengthened its environment, including international Geo-fencing for Azure-hosted environments, deploying additional log monitoring across all servers, and additional hardening of network security rules and protocols to restrict lateral movement across environments
Neighborhood Healthcare transitioned to a new hosting provider
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 18 weeks(127 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 4 states

View merged incident ↗

Montana State AGApr 8 · first

California State AGApr 8 · first

Indiana State AGApr 8 · first

New Hampshire State AG+1d · this page

HHS OCR+6d

Pattern: first filing Apr 8 (MT), last Apr 14 (CA) — a 6-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/bryan-cave-leighton-paisner-20210409.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 9, 2021
Raw hash: 196118244843904328dbec1c1d30079489afae6582da6cc31c63ab0650300687

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityBryan Cave Leighton Paisner LLP

Victim entityNEIGHBORHOOD HEALTHCARE

Incidentdiscovered Dec 3, 2020

Stated responseNetgain took additional measures to contain the threat and address the issue

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov