MalwareGovernmentGovernmentRansomwareData ExfiltratedData EncryptedRansom DemandedCustomer Data InvolvedEmployee Data InvolvedPHIIdentity (basic)Government IDMediumContained

Washington County, Pennsylvania

bd_c81f9b0d43cc09e4 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 24, 2024

Filed

Jun 24, 2024

To disclose

22 weeks

Affected

1state residents only

Confidence

66%

Washington County, PA notified NH AG of a ransomware attack on Jan 24, 2024. Attackers exfiltrated PHI and PII (names, SSNs, DOBs, health info) from Jan 13-24. One NH resident affected. County engaged forensic investigators, alerted law enforcement, and implemented MFA, password resets, and EDR. No dark web release found.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 11 days

discovery → filing · 22 weeks / 152 days

Jan 13, 2024

Begins

Jan 24, 2024

Discovered

Jun 24, 2024

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1 affectedView incident

Name: Washington County, Pennsylvania
norm: washington county

Name: Washington County, Pennsylvania
norm: washington county
Industry: Governmentllm

Discovered: Jan 24, 2024
Breach occurred: Jan 13, 2024 – Jan 24, 2024
Undetected for: 11 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 20, 2024
Affected individuals: 1state-resident count only
Data types: PHIIdentity (basic)Government ID
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Provided notice to the U.S. Department of Health and Human ServicesProvided notice to all appropriate state regulators

During the incident: Began working with a nationally recognized digital forensics team to secure the network and investigate the scope of the incident
Alerted federal law enforcement
Notified the U.S. Department of Health and Human Services and all appropriate state regulators
Changes made: Reviewed and updated firewall rules
Deployed an endpoint detection and response solution across its full network
Reviewed and closed unnecessary remote access routes
Changed all passwords
Enrolled all users in multi-factor authentication
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 22 weeks(152 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/washington-county-pennsylvania-20240624.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 24, 2024
Raw hash: 40f39d67d1356ae2c43dccefa249407b8339ef9083d1ffeb01f9508d889f8403

Reporting entityWashington County, Pennsylvania

Victim entityWashington County, Pennsylvania

Incidentdiscovered Jan 24, 2024

Stated responseBegan working with a nationally recognized digital forensics team to secure the network and investigate the scope of the incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov