Social EngineeringPhishingStolen CredentialsCustomer Data InvolvedEmployee Data InvolvedPIIPHIIDENTITY_BASICLowContained
Onsite Mammography
bd_c686ace3fe4924d6 · schema v1 · pii pii-v1
Full breach record for Onsite Mammography →Onsite Mammography, LLC notified the New Hampshire Attorney General of a data security incident affecting approximately 39 New Hampshire residents. The incident involved unauthorized access to an employee's email account in October 2024, likely via phishing. The actor accessed email content potentially containing PII and PHI. Onsite engaged cybersecurity experts, reset passwords, notified law enforcement, and is offering credit monitoring services.
This filing is one of 5 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (4) · sorted by filing gap
- bd_a946536717595088Vermont State AGfiled 2025-04-21Verified
- bd_a96b83cee14ef51fHHS OCRfiled 2025-04-21Verified
- bd_b49795f765e873bcIndiana State AGfiled 2025-04-21Verified
- bd_c85f887b9fa8986bMaine State AGfiled 2025-04-21Verified
Source provenance
- Source URL
- https://mm.nh.gov/files/uploads/doj/remote-docs/onsite-mammography-20250421.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Apr 21, 2025
- Raw hash
- 92e1e0dc5d523260de930a344c66d74e7a6073026cae66fe13677439a9db4545
Reporting entity
- Name
- Onsite Mammographynorm: onsite mammography
Victim entity
- Name
- Onsite Mammographynorm: onsite mammography
Incident
- Discovered
- Oct 4, 2024
- Materiality determined
- Apr 15, 2025
- Notification sent
- —
- Affected individuals
- 39
- Data types
- PIIPHIIDENTITY_BASIC
- Attack vector
- Phishing
- MITRE ATT&CK
- T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
- Threat actor
- ExternalFinancial
- Regulator citations
- Notified New Hampshire Attorney General
- Initial access
- phishing_link
Compliance
- Time to disclose
- 28 weeks(199 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.