HackingHealthcareHealthcareSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)Government IDMediumContained

Warm Springs Medical Center

bd_df4424e77a13bffe · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 14, 2024

Filed

Jun 13, 2025

To disclose

48 weeks

Affected

1state residents only

Linked

3 filings

Confidence

65%

Full breach record for Warm Springs Medical Center →

Warm Springs Medical Center notified the NH Attorney General of a third-party data breach involving its vendor, Nationwide Recovery Services, Inc. Unauthorized access to NRS's network occurred between July 5-11, 2024. The incident affected one New Hampshire resident, exposing name, SSN, and DOB. Warm Springs discovered the incident on July 14, 2024, and sent notifications on June 13, 2025, offering 12 months of identity protection services.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 9 days

discovery → filing · 48 weeks / 334 days

Jul 5, 2024

Begins

Jul 14, 2024

Discovered

Apr 7, 2025

Scope determined

Jun 13, 2025

Filed

vs. sector median

+38 wks slower

This filing is one of 3 filings about the same incident.View merged incident

Part of Nationwide Recovery Services, Inc. supply-chain incident (2025) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Indiana State AGbd_353a46f588ec18b32025-06-13Candidate
Nebraska State AGbd_9139a6fb1d333b4d2025-06-13Verified

Name: Warm Springs Medical Center
norm: warm springs medical center

Name: Warm Springs Medical Center
norm: warm springs medical center
Industry: Healthcarellm

Discovered: Jul 14, 2024
Breach occurred: Jul 5, 2024 – Jul 11, 2024
Undetected for: 9 daysoccurrence → discovery
Materiality determined: Apr 7, 2025
Notification sent: Jun 13, 2025
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain Compromise
Threat actor: Partner
Regulator citations: Notified federal law enforcement
Third party: via Nationwide Recovery Services, Inc.
Initial access: supply_chain

During the incident: Engaged cybersecurity specialists to assist with their investigation
Reported the incident to federal law enforcement
Worked to identify all individuals whose personal information was shared with NRS
Sent notification letters to the affected New Hampshire resident by USPS First Class Mail
Provided resources and steps individuals can take to help protect their information
Offered individuals the opportunity to enroll in 12 months of complimentary identity protection services through IDX
Changes made: Provided 12 months of credit monitoring, dark web monitoring, a $1 million identity fraud loss reimbursement insurance policy, and fully managed identity theft recovery services through IDX
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 48 weeks(334 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Indiana State AGJun 13 · first

Nebraska State AGJun 13 · first

New Hampshire State AGJun 13 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/warm-springs-medical-center-20250613.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 13, 2025
Raw hash: 253b9247887f9f7f7d5031f97a5040029aca07b0bab0600e734c534f24ebac46

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityWarm Springs Medical Center

Victim entityWarm Springs Medical Center

Incidentdiscovered Jul 14, 2024

Stated responseEngaged cybersecurity specialists to assist with their investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov