HackingHealthcareHealthcareCustomer Data InvolvedTargetedPIIPHIIdentity (basic)Health (basic)MediumContained

Weiser Memorial Hospital

bd_c8db8c8028fa97a1 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 21, 2025

Filed

May 13, 2025

To disclose

22 days

Affected · nationwide

34,24914 in this filing

Linked

8 records

Confidence

65%

Full breach record for Weiser Memorial Hospital →

Weiser Memorial Hospital reported an external system breach (hacking) occurring on September 4, 2024. The incident affected 34,249 individuals, including 14 Maine residents. Notification was sent on May 12, 2025, offering 12-24 months of credit monitoring via Cyberscout. The breach involved PII and PHI.

J jump to incidentP pin to compareR raw source

Leak gap clock✗ Leak >180d22 days discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 229 days

discovery → filing · 22 days

Sep 4, 2024

Begins

Apr 21, 2025

Discovered

May 13, 2025

Filed

vs. sector median

6 wks faster

This filing is one of 8 records about the same incident.View merged incident

A leak claim by embargo about this victim was first seen 225 days before this filing.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Siteembargobd_1181223707c249442024-09-09 · +246dVerified by operator

Regulatory filings (6) · sorted by filing gap

Washington State AGbd_d48216aee2888a042025-05-13Verified
Oregon State AGbd_edb68c5afd87d10a2025-05-13Verified
Montana State AGbd_3b546dd04f86e3f02025-05-12 · +1dVerified
Indiana State AGbd_3dbbf38f268e89b02025-05-12 · +1dVerified

Show 2 more filings ↓up to 2d gap

Vermont State AGbd_b1e67eb07603ddca2025-05-12 · +1dVerified by operator
California State AGbd_05cc3ed436d668872025-05-15 · +2dVerified by operator

Name: Constangy, Brooks, Smith & Prophete, LLP
norm: constangy brooks smith prophete

Name: Weiser Memorial Hospital
norm: weisermemorialhospitalorg
Domain: weisermemorialhospital.org
Industry: Healthcare
Industry: Healthcarellm

Discovered: Apr 21, 2025
Breach occurred: Sep 4, 2024
Undetected for: 229 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 12, 2025
Affected individuals: 34,249state + nationwide
Data types: PIIPHIIdentity (basic)Health (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Filed notification with Maine Attorney General
Initial access: exploit_public_facing

During the incident: Engaged cybersecurity experts to assist with the process
Took steps to secure systems
Undertook a comprehensive review of all potentially affected files
Provided access to Single Bureau Credit Monitoring/Single Bureau Credit Report/Single Bureau Credit Score services at no charge
Changes made: Implemented measures to enhance network security
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 22 days(22 days from discovery to filing)
Compliance flags: Leak >180dME AG ≤30d · 22d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Apr 21, 2025
→ Filed with AG: May 13, 2025
22d 30 days ME AG ≤30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Apr 21, 2025 → Filed with AG: May 13, 2025	22d	30 days	ME AG ≤30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 7 states

View merged incident ↗

Montana State AGMay 12 · first

Indiana State AGMay 12 · first

Vermont State AGMay 12 · first

Washington State AG+1d

Oregon State AG+1d

Maine State AG+1d · this page

California State AG+3d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/7e5d44a8-a4d9-4e49-b2c1-b66ba1cb328d.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 13, 2025
Raw hash: ff32a4d44d205ff78a7a1cb34718740b7ba3c05bd556228c52317a4a43c1811e

Linked disclosures

Ransomware claims (1)

Regulatory filings (6) · sorted by filing gap

Reporting entityConstangy, Brooks, Smith & Prophete, LLP

Victim entityWeiser Memorial Hospital

Incidentdiscovered Apr 21, 2025

Stated responseEngaged cybersecurity experts to assist with the process

ComplianceLeak >180d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov