HackingHealthcareHealthcareVulnerability ExploitStolen CredentialsData ExfiltratedCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDFinancial accountFinancial credentialsPHIHealth (basic)CredentialsHighContained

Highland Health Systems

bd_c07713e459f2d047 · schema v1 · pii pii-v1

Severity

High

Discovered

Jul 3, 2023

Filed

Jun 13, 2024

To disclose

49 weeks

Affected · nationwide

83,54320 in this filing

Linked

6 filings

Confidence

66%

Full breach record for Highland Health Systems →2 incidents on file

Highland Health Systems reported an external system breach (hacking) on July 3, 2023, affecting 83,543 individuals, including 20 Maine residents. Compromised data included SSNs, DOBs, medical info, payment card numbers, and credentials. The company engaged forensic investigators, secured the network, and provided 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Jul 3, 2023 → Filed with AG Jun 13, 2024346d ✗ ME AG >90d49 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 49 weeks / 346 days

Jul 3, 2023

Begins

Jul 3, 2023

Discovered

Jun 13, 2024

Filed

vs. sector median

+37 wks slower

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Massachusetts State AGbd_1cfb9778412976052024-06-13Verified
Montana State AGbd_ab87bef375b265512024-06-13Candidate
Indiana State AGbd_e1fec07cf605cbdd2024-06-13Verified
New Hampshire State AGbd_b522f6b3dfb7f0d02024-06-17 · +4dVerified

Show 1 more filing ↓up to 5d gap

Idaho State AGbd_c020ae850587c7992024-06-18 · +5dVerified

Name: Wilson, Elser, Moskowitz, Edelman & Dicker LLP
norm: wilson elser moskowitz edelman dicker
Domain: wilsonelser.com

Name: Highland Health Systems
norm: highland health
Industry: Healthcarellm

Discovered: Jul 3, 2023
Breach occurred: Jul 3, 2023
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 13, 2024
Affected individuals: 83,543state + nationwide
Data types: Identity (basic)Government IDFinancial accountFinancial credentialsPHIHealth (basic)Credentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: External
Regulator citations: Notified Maine Attorney General
Initial access: exploit_public_facing

During the incident: Disconnected all access to the network
Engaged a specialized third-party cybersecurity firm to assist with securing the environment
Conducted a comprehensive forensic investigation
Changed administrative credentials
Restored operations in a safe and secure mode
Implemented security monitoring software
Adopted new encryption technologies
Deployed additional NIST-compliant technical safeguards
Revised policies and procedures
Retrained workforce members
Engaged a third-party notice vendor to assist with the mailings, call center, and provide identity theft protection services
Changes made: Implemented security monitoring software
Adopted new encryption technologies
Deployed additional NIST-compliant technical safeguards
Revised policies and procedures
Retrained workforce members
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 49 weeks(346 days from discovery to filing)
Compliance flags: ME AG >90d · 346dME resident >180d · 346d
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Jul 3, 2023
→ Filed with AG: Jun 13, 2024
346d 90 days ME AG >90d
Maine
Discovered: Jul 3, 2023
→ Notified: Jun 13, 2024
346d 180 days ME resident >180d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Jul 3, 2023 → Filed with AG: Jun 13, 2024	346d	90 days	ME AG >90d
Maine	Discovered: Jul 3, 2023 → Notified: Jun 13, 2024	346d	180 days	ME resident >180d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Massachusetts State AGJun 13 · first

Montana State AGJun 13 · first

Indiana State AGJun 13 · first

Maine State AGJun 13 · first · this page

New Hampshire State AG+4d

Idaho State AG+5d

Pattern: first filing Jun 13 (MA), last Jun 18 (ID) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/6e492a2d-9560-4756-aeec-a9f5e7168920.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 13, 2024
Raw hash: e1e2168d5b44d1b761ab8c99b1582d7657fd859a74265475e478c63199bff3ea

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityWilson, Elser, Moskowitz, Edelman & Dicker LLP

Victim entityHighland Health Systems

Incidentdiscovered Jul 3, 2023

Stated responseDisconnected all access to the network

ComplianceME AG >90d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov