MalwareHealthcareHealthcareRansomwareData EncryptedData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDHealth (basic)PHIMediumContained

Anchorage Neighborhood Health Center

bd_da91e6360340f573 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Oct 10, 2025

Filed

Nov 24, 2025

To disclose

6 weeks

Affected

36state residents only

Linked

11 filings

Confidence

68%

Full breach record for Anchorage Neighborhood Health Center →

Anchorage Neighborhood Health Center (ANHC) notified the New Hampshire Attorney General of a criminal cyberattack affecting approximately 36 NH residents. Discovered on October 10, 2025, the incident involved unauthorized access to systems containing PII (names, DOB, SSN, driver's licenses) and PHI (medical treatment, health insurance). ANHC engaged third-party experts, deployed 24/7 EDR, rebuilt servers, and reset passwords. Affected individuals received credit monitoring via Experian.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 6 weeks / 45 days

Oct 10, 2025

Discovered

Nov 24, 2025

Filed

vs. sector median

6 wks faster

This filing is one of 11 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

Massachusetts State AGbd_e2e5b7564a8a64f52025-11-25 · +1dVerified
Washington State AGbd_f1e99ab00617f16e2025-11-26 · +2dVerified
Texas State AGbd_e3f42482c6a7a33d2025-11-21 · +3dVerified
Indiana State AGbd_2f7c89d3b6e0c9372025-11-19 · +5dVerified

Show 6 more filings ↓up to 5d gap

Montana State AGbd_583cd41e4a1709902025-11-19 · +5dVerified
Nebraska State AGbd_798fb13746c589ca2025-11-19 · +5dVerified
Maine State AGbd_a2c285d25238254c2025-11-19 · +5dVerified
HHS OCRbd_b0f241cdb20203252025-11-19 · +5dVerified
California State AGbd_d436900ecfb26e672025-11-19 · +5dVerified
Oregon State AGbd_e0c77bd0a7b06d482025-11-19 · +5dVerified

Name: Jackson Lewis
norm: jackson lewis
Domain: jacksonlewis.com

Name: Anchorage Neighborhood Health Center
norm: anchorage neighborhood health center
Industry: Healthcarellm

Discovered: Oct 10, 2025
Materiality determined: —
Notification sent: —
Affected individuals: 36state-resident count only
Data types: Identity (basic)Government IDHealth (basic)PHI
Data elements: Social Security numberDate of birthMedical information
Attack vector: Unknown
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Office of the Attorney General Consumer Protection Bureau

During the incident: Took immediate steps to secure its systems and investigate the nature and scope of the Incident
Deployed endpoint detection and response within its environment, including 24/7 managed detection and response services
Rebuilt all servers impacted by the Incident
Reset all passwords throughout its systems
Reviewing and upgrading its data security policies and procedures
Changes made: Deployed endpoint detection and response within its environment, including 24/7 managed detection and response services
Rebuilt all servers impacted by the Incident
Reset all passwords throughout its systems
Reviewing and upgrading its data security policies and procedures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(45 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 11 states

View merged incident ↗

Indiana State AGNov 19 · first

Montana State AGNov 19 · first

Nebraska State AGNov 19 · first

Maine State AGNov 19 · first

HHS OCRNov 19 · first

California State AGNov 19 · first

Oregon State AGNov 19 · first

Texas State AG+2d

New Hampshire State AG+5d · this page

Massachusetts State AG+6d

Washington State AG+7d

Pattern: first filing Nov 19 (IN), last Nov 26 (WA) — a 7-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/anchorage-neighborhood-health-center-20251124.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 24, 2025
Raw hash: 0e07fb5a858083740a211be6e02c763b92a0f6a102894284fb558d204f7474fd

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entityJackson Lewis

Victim entityAnchorage Neighborhood Health Center

Incidentdiscovered Oct 10, 2025

Stated responseTook immediate steps to secure its systems and investigate the nature and scope of the Incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov