HackingHealthcareHealthcareCustomer Data InvolvedGovernment IDHighContained

Chicago Family Health Center, Inc.

bd_c750e7e318bbe896 · schema v1 · pii pii-v1

Severity

High

Discovered

Jan 25, 2024

Filed

Jun 5, 2024

To disclose

19 weeks

Affected · nationwide

34,9263 in this filing

Linked

5 filings

Confidence

50%

Full breach record for Chicago Family Health Center, Inc. →2 incidents on file

Family Health Center, a healthcare organization, reported a data breach affecting 3 Maine residents. The breach, which was discovered on January 25, 2024, was the result of an external system breach (hacking). The compromised information included names and Social Security numbers. Family Health Center offered 12 months of credit monitoring and identity theft protection services through TransUnion to affected individuals.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Jan 25, 2024 → Filed with AG Jun 5, 2024132d ✗ ME AG >90d19 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 19 weeks / 132 days

Jan 25, 2024

Begins

Jan 25, 2024

Discovered

Jun 5, 2024

Filed

vs. sector median

+7 wks slower

This filing is one of 5 about the same incident.View merged incident

A leak claim by alphv about this victim predates this filing by 102 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitealphvbd_54f7078d105b14b72024-02-23 · +102dVerified

Regulatory filings (3) · sorted by filing gap

Indiana State AGbd_86eb3f69582d61d12024-06-05Verified
Massachusetts State AGbd_b4291f53120883bd2024-06-05Verified by operator
HHS OCRbd_72add7d59a14ecad2024-03-24 · +73dCandidate

Name: Chicago Family Health Center, Inc.
norm: chicago family health center
Domain: fhcenters.org

Name: Chicago Family Health Center, Inc.
norm: chicago family health center
Domain: fhcenters.org
Industry: Healthcarellm

Discovered: Jan 25, 2024
Breach occurred: Jan 25, 2024
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 5, 2024
Affected individuals: 34,926state + nationwide
Data types: Government ID
Data elements: Social Security number
Attack vector: Unauthorized Access

Changes made: Offered 12 months of credit monitoring and identity theft protection services through TransUnion.
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 19 weeks(132 days from discovery to filing)
Compliance flags: ME AG >90d · 132dME resident >60d · 132dLeak >90d
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Jan 25, 2024
→ Filed with AG: Jun 5, 2024
132d 90 days ME AG >90d
Maine
Discovered: Jan 25, 2024
→ Notified: Jun 5, 2024
132d 60 days (analyst band; statutory cap is 30 days) ME resident >60d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Jan 25, 2024 → Filed with AG: Jun 5, 2024	132d	90 days	ME AG >90d
Maine	Discovered: Jan 25, 2024 → Notified: Jun 5, 2024	132d	60 days (analyst band; statutory cap is 30 days)	ME resident >60d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

HHS OCRMar 24 · first

Indiana State AG+73d

Massachusetts State AG+73d

Maine State AG+73d · this page

Pattern: first filing Mar 24 (MI), last Jun 5 (ME) — a 73-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/8fa9ba9d-182a-4114-a450-64633242b78a.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 5, 2024
Raw hash: 9ab8b1ade0dc3c754b06db4849f23217ea8f20f99ba64e9b580791a0aa70a0cb

Linked disclosures

Ransomware claims (1)

Regulatory filings (3) · sorted by filing gap

Reporting entityChicago Family Health Center, Inc.

Victim entityChicago Family Health Center, Inc.

Incidentdiscovered Jan 25, 2024

Stated responseOffered 12 months of credit monitoring and identity theft protection services through TransUnion.

ComplianceME AG >90d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov