Social EngineeringHealthcareHealthcarePhishingBECCustomer Data InvolvedPIIHealth (basic)LowResolved

Bucktail Medical Center

bd_e257f1fe09a46003 · schema v1 · pii pii-v1

Severity

Low

Discovered

Oct 15, 2020

Filed

Apr 14, 2022

To disclose

18 months

Affected

1state residents only

Linked

3 filings

Confidence

67%

Full breach record for Bucktail Medical Center →2 incidents on file

Bucktail Medical Center notified patients of a business email compromise discovered on October 15, 2020. The incident involved unauthorized access to an email account containing patient names, addresses, and health information. BMC engaged forensic investigators, implemented MFA, and provided 12 months of credit monitoring via Kroll.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 18 months / 546 days

Oct 15, 2020

Discovered

Apr 14, 2022

Filed

vs. sector median

+66 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Maine State AGbd_37c1417aa09f2fe22022-04-13 · +1dCandidate
Maine State AGbd_49d49655f6af0abe2022-04-13 · +1dCandidate

Name: Bucktail Medical Center
norm: bucktail medical center

Name: Bucktail Medical Center
norm: bucktail medical center
Industry: Healthcarellm

Discovered: Oct 15, 2020
Materiality determined: —
Notification sent: —
Affected individuals: 1state-resident count only
Data types: PIIHealth (basic)
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Initial access: phishing_link

During the incident: Engaging a third-party cybersecurity firm to conduct a forensics investigation
Engaging a separate third-party vendor to carefully analyze the contents of the email account
Engaging another third-party vendor to assist with mailing the notifications, setting up a call center, and providing complimentary credit monitoring and identity theft protection services
Working with our IT department and security experts to implement a number of new security measures
Changes made: Changed all passwords
Implemented multi-factor authentication
Providing cyber security training to our IT staff
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 18 months(546 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 2 states

View merged incident ↗

Maine State AGApr 13 · first

Montana State AG+1d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/Bucktail-Medical-Center-Consumer-Notification-Letter.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 14, 2022
Raw hash: 7ad547a5bfab2b56e0efde4e8c888ee36fee42f81ecc2952d9b628447da9ef0d

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityBucktail Medical Center

Victim entityBucktail Medical Center

Incidentdiscovered Oct 15, 2020

Stated responseEngaging a third-party cybersecurity firm to conduct a forensics investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov