HackingHealthcareHealthcareStolen CredentialsCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDHealth (basic)Financial accountMediumContained

Capital Region Medical Center

bd_c8480a3cbc771a48 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Dec 17, 2021

Filed

Mar 25, 2022

To disclose

14 weeks

Affected

2state residents only

Linked

6 filings

Confidence

64%

Full breach record for Capital Region Medical Center →

Capital Region Medical Center (CRMC) disclosed that on December 17, 2021, an unauthorized third party gained access to files containing personal and health information of CRMC employees. Data included names, DOB, addresses, medical info, health insurance info, SSNs, and driver's license numbers. CRMC disabled its network, engaged a cybersecurity firm, notified law enforcement, and offered one year of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 14 weeks / 98 days

Dec 17, 2021

Begins

Dec 17, 2021

Discovered

Mar 25, 2022

Filed

vs. sector median

+2 wks slower

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

New Hampshire State AGbd_32f439e24ceb5bee2022-03-25Verified
Maine State AGbd_9adc7a8104cf5c602022-03-25Verified
Indiana State AGbd_6299b52aa0fbf0cf2022-03-24 · +1dVerified by operator
Massachusetts State AGbd_e52487bfa623bfbc2022-03-30 · +5dCandidate

Show 1 more filing ↓up to 14d gap

HHS OCRbd_7ab7349dfcd1fd472022-03-11 · +14dVerified by operator

Name: Capital Region Medical Center
norm: capital region medical center
Domain: crmc.org

Name: Capital Region Medical Center
norm: capital region medical center
Domain: crmc.org
Industry: Healthcarellm

Discovered: Dec 17, 2021
Breach occurred: Dec 17, 2021
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 23, 2021
Affected individuals: 2state-resident count only
Data types: Identity (basic)Government IDHealth (basic)Financial account
Data elements: Social Security numberDate of birthMedical information
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: notice of the incident was provided to the public
Initial access: valid_credentials

During the incident: Disabled our network as a security measure
Initiated an investigation into the incident
A third-party cybersecurity firm was engaged to assist
Law enforcement was also notified
Changes made: Continue to identify opportunities to implement additional cybersecurity measures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 14 weeks(98 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

HHS OCRMar 11 · first

Indiana State AG+13d

New Hampshire State AG+14d

Maine State AG+14d

Montana State AG+14d · this page

Massachusetts State AG+19d

Pattern: first filing Mar 11 (MO), last Mar 30 (MA) — a 19-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/Capital-Region-Medical-Center-Consumer-Notification-Letter.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 25, 2022
Raw hash: babcfe3b9a9180462c5bae32b53078d5185efb7ace6de894b906f60bb74f63fe

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityCapital Region Medical Center

Victim entityCapital Region Medical Center

Incidentdiscovered Dec 17, 2021

Stated responseDisabled our network as a security measure

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov