HackingHealthcareHealthcarePhishingStolen CredentialsTargetedData ExfiltratedIdentity (basic)Government IDHealth (basic)Financial accountMediumContained

Christie Business Holdings Company, P.C.

bd_bbeab82432f036e2 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 10, 2021

Filed

Mar 29, 2022

To disclose

33 weeks

Affected

82state residents only

Linked

5 filings

Confidence

66%

Full breach record for Christie Business Holdings Company, P.C. →

Christie Business Holdings Company, P.C. notified NH AG of unauthorized access to a single business email account from July 14 to August 19, 2021. First detected August 10, 2021. 82 NH residents affected. Data included names, SSNs, medical info, and health insurance info. Actor aimed to intercept a vendor transaction. Response included law enforcement notification, forensic investigation, credit monitoring, and employee training.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 27 days

discovery → filing · 33 weeks / 231 days

Jul 14, 2021

Begins

Aug 10, 2021

Discovered

Mar 29, 2022

Filed

vs. sector median

+21 wks slower

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Montana State AGbd_41094ec2336269212022-03-25 · +4dVerified
Washington State AGbd_a1eb3d1e4ac146d32022-03-25 · +4dVerified by operator
HHS OCRbd_c5da4d2f50aa63532022-03-25 · +4dVerified
Massachusetts State AGbd_d79d45782a7de8d72022-03-25 · +4dVerified

Name: Mullen Coughlin LLC
norm: mullen coughlin

Name: Christie Business Holdings Company, P.C.
norm: christie business
Domain: christieclinic.com
Industry: Healthcarellm

Discovered: Aug 10, 2021
Breach occurred: Jul 14, 2021 – Aug 19, 2021
Undetected for: 27 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 25, 2022
Affected individuals: 82state-resident count only
Data types: Identity (basic)Government IDHealth (basic)Financial account
Data elements: Social Security numberMedical information
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Regulator citations: Notified Office of the New Hampshire Attorney General
Initial access: phishing_link

During the incident: Contacted federal law enforcement and worked with them to mitigate the impact of the unauthorized access
Engaged a leading data forensics firm
Launched an internal investigation
Provided access to credit monitoring services for twelve (12) months, through Experian
Providing impacted individuals with guidance on how to better protect against identity theft and fraud
Changes made: Working to implement additional safeguards and training to its employees
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 33 weeks(231 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Montana State AGMar 25 · first

Washington State AGMar 25 · first

HHS OCRMar 25 · first

Massachusetts State AGMar 25 · first

New Hampshire State AG+4d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/christie-business-holdings-20220329.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 29, 2022
Raw hash: 3eddc165805e916af9415a9b531e3b0afbc53ab6b9646b09a26e4461d513fef2

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityMullen Coughlin LLC

Victim entityChristie Business Holdings Company, P.C.

Incidentdiscovered Aug 10, 2021

Stated responseContacted federal law enforcement and worked with them to mitigate the impact of the unauthorized access

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov