HackingHealthcareHealthcareCustomer Data InvolvedData ExfiltratedPHIGovernment IDIdentity (basic)Health (basic)Financial accountMediumContained

University Medical Center of Southern Nevada

bd_d0c1f4f3c23b9125 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 14, 2021

Filed

Oct 8, 2021

To disclose

17 weeks

Affected

204state residents only

Linked

8 filings

Confidence

66%

Full breach record for University Medical Center of Southern Nevada →5 incidents on file

University Medical Center of Southern Nevada (UMC) experienced a cyberattack on June 14, 2021, compromising files on network servers containing PII and PHI, including SSNs, clinical info, and insurance numbers. The compromise was contained by June 15, 2021. Approximately 204 New Hampshire residents were affected. The attack was attributed to external criminals seeking monetary gain. UMC notified law enforcement and HHS OCR, and offered identity protection services.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 17 weeks / 116 days

Jun 14, 2021

Begins

Jun 14, 2021

Discovered

Oct 8, 2021

Filed

vs. sector median

+6 wks slower

This filing is one of 8 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (7) · sorted by filing gap

Washington State AGbd_756fa6a223b1263e2021-10-11 · +3dVerified
Hawaii State AGbd_b5a43b495ad8cbd72021-10-04 · +4dVerified
California State AGbd_8cd435f422ca0e842021-10-15 · +7dVerified
Oregon State AGbd_d23eb997abdde2de2021-10-20 · +12dVerified

Show 3 more filings ↓up to 67d gap

Maine State AGbd_bceb7eed3b6af9bd2021-10-26 · +18dVerified
HHS OCRbd_63cc22340e1652572021-08-13 · +56dVerified
Indiana State AGbd_eca87a0728f343752021-08-02 · +67dVerified

Name: University Medical Center of Southern Nevada
norm: university medical center of southern nevada
Domain: umecsn.com

Name: University Medical Center of Southern Nevada
norm: university medical center of southern nevada
Domain: umecsn.com
Industry: Healthcarellm

Discovered: Jun 14, 2021
Breach occurred: Jun 14, 2021 – Jun 15, 2021
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 2, 2021
Affected individuals: 204state-resident count only
Data types: PHIGovernment IDIdentity (basic)Health (basic)Financial account
Data elements: Date of birthMedical information
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Reported the cyberattack to the Office of Civil Rights at the United States Department of Health and Human ServicesCommunicated with the Federal Bureau of InvestigationCommunicated with the Las Vegas Metropolitan Police DepartmentCommunicated with the Nevada Attorney General’s Office

During the incident: Restricted external access to UMC servers
Notified the FBI and the Las Vegas Metropolitan Police Department
Engaged external cyber security professionals
Offered complimentary identity protection services through IDX
Changes made: Updating internal and external technology solutions to further strengthen UMC from cyberattacks
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 17 weeks(116 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 8 states

View merged incident ↗

Indiana State AGAug 2 · first

HHS OCR+11d

Hawaii State AG+63d

New Hampshire State AG+67d · this page

Washington State AG+70d

California State AG+74d

Oregon State AG+79d

Maine State AG+85d

Pattern: first filing Aug 2 (IN), last Oct 26 (ME) — a 85-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/university-medical-center-southern-nevada-20211008.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 8, 2021
Raw hash: fb3d2a58f8ec6116d0f9eb193278f33c728691f2a72bb2420763290b6d675cc0

Linked disclosures

Regulatory filings (7) · sorted by filing gap

Reporting entityUniversity Medical Center of Southern Nevada

Victim entityUniversity Medical Center of Southern Nevada

Incidentdiscovered Jun 14, 2021

Stated responseRestricted external access to UMC servers

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov