HackingStolen CredentialsCapture Stored DataSupply Chain (3P Vendor)Customer Data InvolvedEmployee Data InvolvedIDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTHEALTH_BASICMediumContained
RHEA MEDICAL CENTER
bd_d8fbb865101157b6 · schema v1 · pii pii-v1
Full breach record for RHEA MEDICAL CENTER →Rhea Medical Center notified consumers of a data breach involving its third-party vendor, National Recovery Services (NRS). Unauthorized access occurred July 5-11, 2024, exposing names, SSNs, DOBs, financial accounts, and medical info. NRS discovered the breach in July 2024. Rhea Medical Center secured systems, engaged law enforcement, and implemented new cybersecurity measures.
Vermont clock✗ VT AG >45 bday49 weeks discovery → filing
⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident
Source provenance
- Source URL
- https://ago.vermont.gov/document/2025-06-11-rhea-medical-center-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jun 11, 2025
- Raw hash
- 82cb2ece42fc3cce1fd9c000ce04109e347020fb0cc0f7a203dc31057c9070f9
Reporting entity
- Name
- RHEA MEDICAL CENTERnorm: rhea medical center
Victim entity
- Name
- RHEA MEDICAL CENTERnorm: rhea medical center
Incident
- Discovered
- Jul 5, 2024
- Materiality determined
- —
- Notification sent
- Mar 1, 2025
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTHEALTH_BASIC
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1195 Supply Chain CompromiseT1078 Valid AccountsT1119 Automated Collection
- Threat actor
- ExternalFinancial
- Regulator citations
- Reported this incident to federal law enforcement
- Third party
- via National Recovery Services
- Initial access
- supply_chain
Compliance
- Time to disclose
- 49 weeks(341 days from discovery to filing)
- Compliance flags
- VT AG >45 bday
- Discovery-date grounding
- occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.