HackingHealthcareHealthcareStolen CredentialsData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDHealth (basic)PHIMediumContained

Senior Living, LLC

bd_bdb383302de73cae · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 7, 2021

Filed

Oct 12, 2021

To disclose

31 weeks

Affected

2state residents only

Linked

2 filings

Confidence

66%

Full breach record for Senior Living, LLC →2 incidents on file

Senior Living, LLC d/b/a Bridgeway Care and Rehab Center at Hillsborough and Pilgrim River, LLC d/b/a The Avalon Assisted Living Residence at Hillsborough notified the NH AG of unauthorized network access between March 3-7, 2021. The incident affected 2 NH residents, exposing names, SSNs, medical diagnoses, and medical record numbers. The organization engaged outside cybersecurity professionals for forensic investigation and provided 12 months of credit monitoring to affected residents.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 4 days

discovery → filing · 31 weeks / 219 days

Mar 3, 2021

Begins

Mar 7, 2021

Discovered

Oct 12, 2021

Filed

vs. sector median

+20 wks slower

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_04cce5565990a7d32021-10-07 · +5dVerified

Name: Senior Living, LLC
norm: senior living

Name: Senior Living, LLC
norm: senior living
Also named: Senior Living, LLCdba oflegal entity
Bridgeway Care and Rehab Center at Hillsboroughdba oftrade name
Industry: Healthcarellm

Discovered: Mar 7, 2021
Breach occurred: Mar 3, 2021 – Mar 7, 2021
Undetected for: 4 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 7, 2021
Affected individuals: 2state-resident count only
Data types: Identity (basic)Government IDHealth (basic)PHI
Data elements: Social Security numberMedical information
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Office of the Attorney General
Initial access: valid_credentials

During the incident: Took steps to secure their network and mitigate against any additional harm
Launched an investigation in consultation with outside cybersecurity professionals
Providing 12 months of credit monitoring to any resident whose Social Security number was impacted
Advising the affected residents to always remain vigilant in reviewing financial account statements
Advising the affected residents about the process for placing a fraud alert and/or security freeze on their credit files
Providing the contact information for the consumer reporting agencies and the Federal Trade Commission
Changes made: Continually evaluate and modify their practices to enhance the security and privacy of the personal information they maintain
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 31 weeks(219 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Massachusetts State AGOct 7 · first

New Hampshire State AG+5d · this page

Pattern: first filing Oct 7 (MA), last Oct 12 (NH) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/senior-living-dba-bridgeway-care-rehab-center-hillsborough-pilgrim-river-dba-avalon-assisted-living-residence-hillsborough-20211012.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 12, 2021
Raw hash: 933f158c8f74baa86edd184172235719d823ab079f32b985b7af821c10b91c72

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entitySenior Living, LLC

Victim entitySenior Living, LLC

Incidentdiscovered Mar 7, 2021

Stated responseTook steps to secure their network and mitigate against any additional harm

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov