Social EngineeringHealthcareHealthcarePhishingData ExfiltratedCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDFinancial accountHealth (basic)PIIHighContained

Genoa Community Hospital/LTC aka Genoa Medical Facilities

bd_d907994eb462ca68 · schema v1 · pii pii-v2

Severity

High

Discovered

Mar 27, 2025

Filed

Jul 30, 2025

To disclose

—

Affected

2,328state residents only

Linked

2 filings

Confidence

66%

Full breach record for Genoa Community Hospital/LTC aka Genoa Medical Facilities →

Genoa Community Hospital/LTC reported a data security incident in Nebraska involving unauthorized access to an employee email account starting March 27, 2025. The breach affected 2,328 Nebraska residents, exposing names, SSNs, financial account info, and medical data. Genoa notified the Nebraska AG on August 4, 2025, and provided 12 months of credit monitoring via Experian.

J jump to incidentP pin to compareR raw source

Incident timeline

Mar 27, 2025

Begins

Mar 27, 2025

Discovered

Jul 30, 2025

Filed

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Illinois State AGbd_ce3be2cf1752f7352025-08-01 · +2dVerified

Name: Constangy, Brooks, Smith & Prophete, LLP
norm: constangy brooks smith prophete

Name: Genoa Community Hospital/LTC aka Genoa Medical Facilities
norm: genoa community hospital ltc aka genoa medical facilities
Industry: Healthcarellm

Discovered: Mar 27, 2025
Breach occurred: Mar 27, 2025
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 30, 2025
Affected individuals: 2,328state-resident count only
Data types: Identity (basic)Government IDFinancial accountHealth (basic)PII
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid Accounts
Threat actor: External
Regulator citations: Notified Nebraska Attorney General
Initial access: phishing_link

During the incident: Initiated an investigation
Undertook a comprehensive review
Arranged to send letters to all potentially affected individuals
Took steps to secure its systems
Launched an investigation to learn more about what happened
Implemented additional safeguards to enhance the security of its systems
Established a toll-free call center
Providing notified individuals whose Social Security numbers may have been involved with twelve (12) months of free credit monitoring and identity protection services through Experian
Changes made: Reviewing existing policies and procedures
Implementing enhanced security measures
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Nebraska State AGJul 30 · first · this page

Illinois State AG+2d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://nebraska.gov/ago/data-breach/documents/f0665d9d-01bc-41f5-81e6-cd184f7cc608.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 30, 2025
Raw hash: 814c8a6fc354d6aef7fe5ba35c9bfd5825e574ec70cee45418e96699589cd32f

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityConstangy, Brooks, Smith & Prophete, LLP

Victim entityGenoa Community Hospital/LTC aka Genoa Medical Facilities

Incidentdiscovered Mar 27, 2025

Stated responseInitiated an investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancenebraska.gov