HackingHealthcareEducationHealthcareStolen CredentialsCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDHealth (basic)PHIMediumContained

University of Connecticut Health Center

bd_c87381ee8c7e2e50 · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Feb 22, 2019

To disclose

—

Affected

339state residents only

Confidence

66%

Full breach record for University of Connecticut Health Center →3 incidents on file

UConn Health notified the NH Attorney General that an unauthorized person remotely accessed employee email accounts in August 2018. The incident potentially impacted 339 New Hampshire residents. Affected data included names, addresses, Social Security numbers, dates of birth, driver's license numbers, and limited medical information. UConn Health secured accounts, engaged forensic investigators, and offered identity theft protection.

J jump to incidentP pin to compareR raw source

Incident timeline

Aug 1, 2018

Begins

Feb 22, 2019

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed339 affectedView incident

Name: University of Connecticut Health Center
norm: university of connecticut health center

Name: University of Connecticut Health Center
norm: university of connecticut health center
Industry: HealthcarellmEducationllm

Discovered: —
Breach occurred: Aug 1, 2018 – Aug 31, 2018
Materiality determined: —
Notification sent: Feb 21, 2019
Affected individuals: 339state-resident count only
Data types: Identity (basic)Government IDHealth (basic)PHI
Data elements: Social Security numberDate of birthMedical information
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: External
Regulator citations: Notified the Attorney General of the State of New Hampshire

During the incident: Secured the email account credentials
Notified law enforcement
Retained a leading forensic security firm to investigate and confirm the overall security of its email and computer systems
Providing complimentary identity theft protection services to all individuals whose social security numbers were contained in the email account through Experian
Changes made: Evaluating additional platforms for educating staff
Reviewing technical controls
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/university-connecticut-health-20190222.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 22, 2019
Raw hash: 41e3e28a0cdf41e1ef2d385ff65cd8250895b7dd07adf964d32809ab1847d0e6

Reporting entityUniversity of Connecticut Health Center

Victim entityUniversity of Connecticut Health Center

IncidentUnauthorized Access

Stated responseSecured the email account credentials

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov