MalwareTechnologyHealthcareInformationRansomwareStolen CredentialsData ExfiltratedRansom DemandedBusiness Associate (HIPAA)Downstream VictimsCustomer Data InvolvedTargetedPIIFinancial accountIdentity (basic)LowContained

The Medibase Group, Inc.

bd_e7b512c7209a0428 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jan 29, 2024

Filed

Jul 24, 2024

To disclose

25 weeks

Affected

2state residents only

Linked

5 filings

Confidence

66%

Full breach record for The Medibase Group, Inc. →2 incidents on file

Medibase Group, Inc., a business associate for healthcare providers, disclosed a ransomware incident affecting 2 New Hampshire residents. The breach occurred around Jan 26, 2024, and was detected on Jan 29, 2024. PII and financial data were accessed. Medibase contained the threat, recovered encryption keys, and provided credit monitoring to affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 3 days

discovery → filing · 25 weeks / 177 days

Jan 26, 2024

Begins

Jan 29, 2024

Discovered

May 28, 2024

Scope determined

Jul 24, 2024

Filed

vs. sector median

+14 wks slower

This filing is one of 5 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Massachusetts State AGbd_490e3440c8c560282024-07-24Verified by operator
South Carolina State AGbd_782456d9b989a6982024-07-11 · +13dVerified
Massachusetts State AGbd_5daed7698055ce5b2024-07-05 · +19dVerified
HHS OCRbd_70b6c77ab26f0a7e2024-07-05 · +19dVerified

Name: The Medibase Group, Inc.
norm: the medibase

Name: The Medibase Group, Inc.
norm: the medibase
Industry: TechnologyllmHealthcarellm

Discovered: Jan 29, 2024
Breach occurred: Jan 26, 2024
Undetected for: 3 daysoccurrence → discovery
Materiality determined: May 28, 2024
Notification sent: Jul 24, 2024
Affected individuals: 2state-resident count only
Data types: PIIFinancial accountIdentity (basic)
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney Generalreported this incident to U.S. federal law enforcement
Initial access: valid_credentials

During the incident: Shut down its network and systems
Stopped any such activity
Launched an investigation with the assistance of leading cybersecurity specialists
Engaged industry-leading specialists in cybersecurity and forensic investigations
Negotiated the release of the files
Obtained the encryption key
Obtained proof of deletion of the files
Obtained assurances from the TA that the data would not be released or misused
Deployed forensic tools to monitor the dark web
Reported this incident to U.S. federal law enforcement
Scanned our environment
Implemented additional security measures
Providing credit monitoring and other identity theft protection services
Changes made: Implemented additional security measures
Evaluate and deploy the level of robust security protocols
Continuous monitoring
Staff training
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 25 weeks(177 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 4 states

View merged incident ↗

Massachusetts State AGJul 5 · first

HHS OCRJul 5 · first

South Carolina State AG+6d

Massachusetts State AG+19d

New Hampshire State AG+19d · this page

Pattern: first filing Jul 5 (MA), last Jul 24 (NH) — a 19-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/medibase-group-20240724.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 24, 2024
Raw hash: caa15b470cb2c0bcaf97678df3a62e13dc7a6972f4f28b3ebc6c832955ac6388

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityThe Medibase Group, Inc.

Victim entityThe Medibase Group, Inc.

Incidentdiscovered Jan 29, 2024

Stated responseShut down its network and systems

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov