HackingHealthcareProfessional ServicesHealthcareData MishandlingSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)Government IDFinancial accountHealth (basic)PHIMediumActive

Hofmann Arthritis Institute PLLC

bd_bedeb64007eb1e04 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 15, 2021

Filed

Feb 22, 2022

To disclose

14 weeks

Affected

1state residents only

Linked

6 filings

Confidence

66%

Full breach record for Hofmann Arthritis Institute PLLC →

Hofmann Arthritis Institute PLLC notified the New Hampshire AG of a data event involving its third-party vendor, Alta Medical Management. Discovered Nov 15, 2021, the incident potentially affected 1 NH resident's PII, PHI, and financial data. HAI is providing credit monitoring and reviewing vendor policies.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 14 weeks / 99 days

Nov 15, 2021

Discovered

Feb 22, 2022

Filed

vs. sector median

+2 wks slower

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Indiana State AGbd_18c63d635dbb36762022-02-17 · +5dVerified
Montana State AGbd_3d6dcd8f59be42be2022-02-17 · +5dVerified
Massachusetts State AGbd_2e6be3c3975db52f2022-02-15 · +7dVerified
HHS OCRbd_9d925df8640414c72022-02-04 · +18dVerified

Show 1 more filing ↓up to 52d gap

Illinois State AGbd_8984c6cadc66c1652022-01-01 · +52dCandidate

Name: Mullen Coughlin LLC
norm: mullen coughlin

Name: Hofmann Arthritis Institute PLLC
norm: hofmann arthritis institute
Industry: HealthcarellmProfessional Servicesllm

Discovered: Nov 15, 2021
Materiality determined: —
Notification sent: Feb 4, 2022
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government IDFinancial accountHealth (basic)PHI
Data elements: Date of birthMedical information
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain Compromise
Threat actor: External
Regulator citations: Notified Office of the New Hampshire Attorney General
Initial access: supply_chain

During the incident: HAI immediately commenced an investigation and gathered information from AMM
HAI performed a comprehensive review to identify and provide notification of the incident
HAI is providing complimentary access to credit monitoring services for one (1) year through IDX
HAI is providing impacted individuals with guidance on how to better protect against identity theft and fraud
HAI is reviewing existing policies and procedures regarding its third-party vendors
HAI is working to evaluate additional measures and safeguards to protect against this type of incident in the future
Changes made: Reviewing existing policies and procedures regarding its third-party vendors
Working to evaluate additional measures and safeguards to protect against this type of incident in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 14 weeks(99 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Illinois State AGJan 1 · first

HHS OCR+34d

Massachusetts State AG+45d

Indiana State AG+47d

Montana State AG+47d

New Hampshire State AG+52d · this page

Pattern: first filing Jan 1 (IL), last Feb 22 (NH) — a 52-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/hofmann-arthritist-institute-hofman-arthritis-institute-nevada-20220222.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 22, 2022
Raw hash: c9297ba111d4a28eee7bfc8e5ba5db1219800ae19c222831551ee09eab77da74

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityMullen Coughlin LLC

Victim entityHofmann Arthritis Institute PLLC

Incidentdiscovered Nov 15, 2021

Stated responseHAI immediately commenced an investigation and gathered information from AMM

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov