HackingHealthcareHealthcareTargetedData ExfiltratedIdentity (basic)MediumResolved

Community Dental

bd_eef5da71e0c26cfc · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 10, 2024

Filed

Oct 22, 2024

To disclose

6 weeks

Affected · nationwide

1,461270 in this filing

Linked

5 records

Confidence

66%

Full breach record for Community Dental →2 incidents on file

Community Dental, a healthcare provider in Portland, ME, reported an external system breach (hacking) occurring Sept 19-20, 2023. Discovered Sept 10, 2024, the incident affected 1,461 individuals (270 in Maine). Names were compromised. Notices sent Oct 16, 2024, offering Experian credit monitoring.

J jump to incidentP pin to compareR raw source

Leak gap clock✗ Leak >180d6 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 357 days

discovery → filing · 6 weeks / 42 days

Sep 19, 2023

Begins

Sep 10, 2024

Discovered

Oct 22, 2024

Filed

vs. sector median

3 wks faster

This filing is one of 5 records about the same incident.View merged incident

A leak claim by lockbit_3 about this victim was first seen 340 days before this filing.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitelockbit_3bd_2c0ea5bd713497732023-09-19 · +399dVerified by operator

Regulatory filings (3) · sorted by filing gap

New Hampshire State AGbd_2b2ad1298b1d2eeb2024-10-22Verified by operator
Massachusetts State AGbd_7fdc21eb5caa3de02024-10-22Verified by operator
HHS OCRbd_8d67a6837dc854b72023-11-17 · +340dVerified

Name: Community Dental
norm: community dental
Domain: communitydentalme.org

Name: Community Dental
norm: community dental
Domain: communitydentalme.org
Industry: Healthcarellm

Discovered: Sep 10, 2024
Breach occurred: Sep 19, 2023 – Sep 20, 2023
Undetected for: 357 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 16, 2024
Affected individuals: 1,461state + nationwide
Data types: Identity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: External
Regulator citations: Reported the event to federal law enforcement and government regulators
Initial access: exploit_public_facing

During the incident: Immediately launched an investigation
Took steps to contain this activity and secure systems
Began working with cyber incident response specialists
Reported the event to federal law enforcement and government regulators
Offering 12 or 24 months of credit monitoring and identity restoration services through Experian
Changes made: Implemented additional security measures to further protect data in our care
Continue to enhance these protections as part of ongoing commitment to data security
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(42 days from discovery to filing)
Compliance flags: Leak >180dME AG >30d · 42d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Sep 10, 2024
→ Filed with AG: Oct 22, 2024
42d 30 days (soft) ME AG >30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Sep 10, 2024 → Filed with AG: Oct 22, 2024	42d	30 days (soft)	ME AG >30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 3 states

View merged incident ↗

HHS OCRNov 17 · first

New Hampshire State AG+340d

Massachusetts State AG+340d

Maine State AG+340d · this page

Pattern: first filing Nov 17 (ME), last Oct 22 (ME) — a 340-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/f52c9979-447f-421d-a513-a05cb2d2063d.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 22, 2024
Raw hash: e21d120f6669dd12bab62b7ea6deecafc5e1fe4c025be8c766676294dc97aae4

Linked disclosures

Ransomware claims (1)

Regulatory filings (3) · sorted by filing gap

Reporting entityCommunity Dental

Victim entityCommunity Dental

Incidentdiscovered Sep 10, 2024

Stated responseImmediately launched an investigation

ComplianceLeak >180d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov