MAINEHackingHealthcareHealthcareStolen CredentialsCustomer Data InvolvedData ExfiltratedDelayed DiscoveryHealth (basic)Identity (basic)Government IDMetadataCriticalResolved

Maine General Health

bd_d5ea91f5b6ff8fb8 · schema v1 · pii pii-v1

Severity

Critical

Discovered

Nov 13, 2015

Filed

Dec 8, 2015

To disclose

25 days

Affected

120,247

Confidence

96%

Full breach record for Maine General Health →

Maine General Health (ME) reported to HHS OCR on 2015-12-08 a Hacking/IT Incident affecting approximately 120,247 individuals. On November 13, 2015, the FBI informed the CE it had discovered CE data on an online Russian message board. Internet-browsing activity on a CE workstation led to malware infection; an intruder remotely scanned the network, stole credentials, and accessed servers containing PHI including names, demographics, dates of birth, diagnoses, treatments, medical record numbers, and health insurance IDs. Breached info resided on network servers. OCR obtained assurances of corrective action completion.

J jump to incidentP pin to compareR raw source

HIPAA clock✓ HHS report on time25 days discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

discovery → filing · 25 days

Nov 13, 2015

Discovered

Dec 8, 2015

Filed

vs. sector median

9 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed120,247 affectedView incident

Name: Maine General Health
norm: maine general health
Industry: Health Care Services

Name: Maine General Health
norm: maine general health
Industry: Health Care Services
Industry: Healthcaresource default

Discovered: Nov 13, 2015
Materiality determined: —
Notification sent: —
Affected individuals: 120,247nationwide
Data types: Health (basic)Identity (basic)Government IDMetadata
HHS breach type: Hacking / IT incident
Where the data lived: Network server
Covered-entity type: Healthcare provider
Attack vector: Unauthorized Access
MITRE ATT&CK: T1189 Drive-by CompromiseT1078 Valid AccountsT1590 Gather Victim Network Information
Threat actor: ExternalFinancial
Regulator citations: FBI informed Maine General Health on November 13, 2015 of CE data discovered on an online Russian message board during an ongoing criminal investigation.Breach notification provided to HHS, affected individuals, and the media.OCR obtained assurances that the CE implemented corrective actions.
Initial access: drive_by_compromise

During the incident: Updated passwords
Disabled infrequently used domain administrator accounts
Reconfigured firewalls
Updated access control lists
Installed a secondary web filtering appliance
Implemented tighter application controls
Implemented additional restrictions on viewing/clicking on advertisements
Reduced access to virtual network
Changes made: Improved technical and administrative safeguards
Corrective action plan implemented; OCR obtained assurances of completion
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 25 days(25 days from discovery to filing)
Compliance flags: HHS report on timeHHS notified
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: Nov 13, 2015
→ Notified: not extracted
— 60 days HHS report on time
HIPAA
Discovered: Nov 13, 2015
→ Notified: not extracted
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: Nov 13, 2015 → Notified: not extracted	—	60 days	HHS report on time
HIPAA	Discovered: Nov 13, 2015 → Notified: not extracted	—	regulatory submission	HHS notified

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Dec 8, 2015
Raw hash: fd230676f3f2a18d2bf3b91f721180f55c6721fdecf283e5e3f5e0488020848f

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html2.4 KB

Download View at source

Reporting entityMaine General Health

Victim entityMaine General Health

Incidentdiscovered Nov 13, 2015

Stated responseUpdated passwords

ComplianceHHS report on time

Extraction provenanceno artifact recorded

Source provenanceocrportal.hhs.gov

Source filing