MalwareHealthcareHealthcareRansomwareRansom DemandedTargetedPIIIdentity (basic)LowContained

Wayne Memorial Hospital

bd_e1539c0ea8da5574 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jun 3, 2024

Filed

Sep 7, 2025

To disclose

15 months

Affected

Not disclosed

Linked

11 filings

Confidence

64%

Full breach record for Wayne Memorial Hospital →2 incidents on file

Wayne Memorial Hospital experienced a ransomware event detected on June 3, 2024. An unauthorized actor accessed the network between May 30 and June 3, 2024, encrypted data, and left a ransom note. The hospital restored systems from backups, engaged forensic investigators, and offered credit monitoring. The primary motive was extortion. No evidence of identity theft was found.

J jump to incidentP pin to compareR raw source

Vermont clock✗ VT AG >45 bday15 months discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 4 days

discovery → filing · 15 months / 461 days

May 30, 2024

Begins

Jun 3, 2024

Discovered

Sep 7, 2025

Filed

vs. sector median

+55 wks slower

This filing is one of 11 about the same incident.View merged incident

A leak claim by monti about this victim predates this filing by 461 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (2)

Leak Sitemontibd_b9a1b20ea9c4502f2024-06-30 · +433dVerified
Leak Sitemontibd_ead7e5cf61e941172024-06-03 · +461dVerified

Regulatory filings (8) · sorted by filing gap

Maine State AGbd_4b1cd5f26ef29daa2025-09-07Verified
Massachusetts State AGbd_8d43056b8b431a352025-09-07Verified
Montana State AGbd_fb6dd2f52bc66a392025-09-07Verified
New Hampshire State AGbd_4a3a5b5a92d6120f2025-09-08 · +1dVerified

Show 4 more filings ↓up to 401d gap

Texas State AGbd_5c0d27e2856b33002025-09-09 · +2dVerified
Nebraska State AGbd_a18fbae130892d282025-08-27 · +11dVerified
Indiana State AGbd_325db4432f75dfd12025-08-02 · +36dVerified
HHS OCRbd_a42c696e8556d0362024-08-02 · +401dVerified

Name: Wayne Memorial Hospital
norm: wayne memorial hospital
Domain: wmh.org

Name: Wayne Memorial Hospital
norm: wayne memorial hospital
Domain: wmh.org
Industry: Healthcarellm

Discovered: Jun 3, 2024
Breach occurred: May 30, 2024 – Jun 3, 2024
Undetected for: 4 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 27, 2025
Affected individuals: Not disclosed
Data types: PIIIdentity (basic)
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1078 Valid Accounts
Threat actor: ExternalFinancial
Initial access: valid_credentials

During the incident: Disconnected access to its network and took certain systems offline
Restored its network from backups
Engaged legal counsel and cybersecurity professionals
Added new intrusion detection and response tools
Reset all passwords
Made additional enhancements to WMH’s network security
Engaged specialized cybersecurity professionals to conduct a forensic investigation
Published a public notice of this event on its website
Published a media notice with the Press Sentinel
Provided access to Single Bureau Credit Monitoring, Credit Report, and Credit Score services at no charge
Provided proactive fraud assistance
Changes made: Added new intrusion detection and response tools
Reset all passwords
Made additional enhancements to WMH’s network security
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 15 months(461 days from discovery to filing)
Compliance flags: VT AG >45 bdayLeak >180d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 9 filings · 9 states

View merged incident ↗

HHS OCRAug 2 · first

Indiana State AG+365d

Nebraska State AG+390d

Maine State AG+401d

Massachusetts State AG+401d

Montana State AG+401d

Vermont State AG+401d · this page

New Hampshire State AG+402d

Texas State AG+403d

Pattern: first filing Aug 2 (GA), last Sep 9 (TX) — a 403-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ago.vermont.gov/document/2025-09-07-wayne-memorial-hospital-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 7, 2025
Raw hash: 8912e963bdbb4c8291f742a2c51b51be43ea62d0b459f0deffa5c9a8bf1c619c

Linked disclosures

Ransomware claims (2)

Regulatory filings (8) · sorted by filing gap

Reporting entityWayne Memorial Hospital

Victim entityWayne Memorial Hospital

Incidentdiscovered Jun 3, 2024

Stated responseDisconnected access to its network and took certain systems offline

ComplianceVT AG >45 bday

Extraction provenanceno artifact recorded

Source provenanceago.vermont.gov