PhysicalHealthcareFinancial ServicesHealthcareTheftCustomer Data InvolvedPHIGovernment IDIdentity (basic)Health (basic)MediumActive

New West Health Services

bd_e3fc14d84ca07457 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 18, 2015

Filed

Jan 15, 2016

To disclose

8 weeks

Affected

5state residents only

Linked

4 filings

Confidence

66%

Full breach record for New West Health Services →

New West Health Services d/b/a New West Medicare reported the theft of a company laptop on November 18, 2015, in Missoula, Montana. The unencrypted laptop contained personal and health information of five New Hampshire residents, including names, addresses, Social Security numbers, Medicare claim numbers, and for two individuals, medical history and diagnosis. The company notified the NH Attorney General and affected residents on January 15, 2016, and offered one year of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 8 weeks / 58 days

Nov 18, 2015

Begins

Nov 18, 2015

Discovered

Jan 15, 2016

Filed

vs. sector median

4 wks faster

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

HHS OCRbd_50636571c30346c12016-01-15Verified
Montana State AGbd_a736a2b4b879b4342016-01-15Candidate
Massachusetts State AGbd_b9d71238ba360aa82016-01-19 · +4dVerified

Name: New West Health Services d/b/a New West Medicare
norm: new west health services
Domain: newwestmedicare.com

Name: New West Health Services
norm: new west health
Domain: newwestmedicare.com
Also named: New West Health Servicesdba oflegal entity
New West Medicaredba oftrade name
Industry: HealthcarellmFinancial Servicesllm

Discovered: Nov 18, 2015
Breach occurred: Nov 18, 2015
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 15, 2016
Affected individuals: 5state-resident count only
Data types: PHIGovernment IDIdentity (basic)Health (basic)
Data elements: Social Security numberDate of birthMedical information
Attack vector: Unknown
MITRE ATT&CK: T1052 Exfiltration Over Physical Medium
Regulator citations: Notified the Attorney General of the State of New Hampshire

During the incident: Launched an investigation to determine what information it contained
Notified the Missoula police department
Retained Navigant, a leading national computer forensics firm, to assist in its investigation
Established a call center for affected customers
Established a website for customers to receive helpful information
Offered one year of complimentary credit monitoring and identity theft protection services through Experian
Changes made: Ensure that encryption is installed on all New West laptops containing sensitive personal and health information
Providing additional education and training for all its employees on cybersecurity, including computer and laptop security best practices
Reviewing its data security policies and practices in light of this incident and will enhance those policies and practices as necessary and appropriate
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(58 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 3 states

View merged incident ↗

HHS OCRJan 15 · first

Montana State AGJan 15 · first

New Hampshire State AGJan 15 · first · this page

Massachusetts State AG+4d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/new-west-health-20160115.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 15, 2016
Raw hash: dc6612d1dc76b31686eec2f5c6f285f30f63cd122532eae6f5244c6e2b4d3c51

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityNew West Health Services d/b/a New West Medicare

Victim entityNew West Health Services

Incidentdiscovered Nov 18, 2015

Stated responseLaunched an investigation to determine what information it contained

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov