HackingHealthcareHealthcareData ExfiltratedTargetedIdentity (basic)Financial accountMediumContained

Connecticut GI, PLLC

bd_f23f489d33c53c34 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 19, 2024

Filed

Nov 26, 2024

To disclose

23 weeks

Affected · nationwide

10,5685 in this filing

Linked

5 filings

Confidence

66%

Full breach record for Connecticut GI, PLLC →2 incidents on file

Connecticut GI, PLLC and Gastroenterology Associates of Fairfield, P.C. reported an external system breach (hacking) occurring June 5-7, 2024, discovered June 19, 2024. Approximately 10,568 individuals were affected, including 5 Maine residents. Compromised data included names and financial account information. The entity engaged forensic specialists, notified regulators and credit bureaus, and offered 24 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Jun 19, 2024 → Filed with AG Nov 26, 2024160d ⏱ ME AG >30d23 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 14 days

discovery → filing · 23 weeks / 160 days

Jun 5, 2024

Begins

Jun 19, 2024

Discovered

Nov 26, 2024

Filed

vs. sector median

+14 wks slower

This filing is one of 5 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

New Hampshire State AGbd_2619379e90b44e002024-11-26Verified
Vermont State AGbd_881fa24823a32ffd2024-11-26Verified
Indiana State AGbd_a95e1d09b769d4c52024-11-26Verified
Illinois State AGbd_f4e97709131ee9a12024-11-01 · +25dVerified by operator

Name: Connecticut GI, PLLC
norm: connecticut gi
Domain: connecticutgi.org

Name: Connecticut GI, PLLC
norm: connecticut gi
Domain: connecticutgi.org
Industry: Healthcarellm

Discovered: Jun 19, 2024
Breach occurred: Jun 5, 2024 – Jun 7, 2024
Undetected for: 14 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 26, 2024
Affected individuals: 10,568state + nationwide
Data types: Identity (basic)Financial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Providing written notice to relevant state and federal regulatorsNotifying the U.S. Department of Health and Human Services
Initial access: exploit_public_facing

During the incident: Engaged with a third-party forensic specialist to assist in conducting a comprehensive investigation
Providing access to credit monitoring services for twenty-four (24) months through IDX, a ZeroFox Company
Providing written notice of this incident to relevant state and federal regulators
Providing written notice to the three major credit reporting agencies, Equifax, Experian, and TransUnion
Notifying the U.S. Department of Health and Human Services
Changes made: Working to implement additional technical safeguards
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 23 weeks(160 days from discovery to filing)
Compliance flags: ME AG >30d · 160dME resident >60d · 160d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Jun 19, 2024
→ Filed with AG: Nov 26, 2024
160d 30 days (soft) ME AG >30d
Maine
Discovered: Jun 19, 2024
→ Notified: Nov 26, 2024
160d 60 days (analyst band; statutory cap is 30 days) ME resident >60d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Jun 19, 2024 → Filed with AG: Nov 26, 2024	160d	30 days (soft)	ME AG >30d
Maine	Discovered: Jun 19, 2024 → Notified: Nov 26, 2024	160d	60 days (analyst band; statutory cap is 30 days)	ME resident >60d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Illinois State AGNov 1 · first

New Hampshire State AG+25d

Vermont State AG+25d

Indiana State AG+25d

Maine State AG+25d · this page

Pattern: first filing Nov 1 (IL), last Nov 26 (ME) — a 25-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/bebddcd5-a57e-4de4-a60d-2a352979e4cc.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 26, 2024
Raw hash: 0d0fd42f3ccee19a1cd7b90dd4d866ef35872dd8c2f8e4cdffe47bbc0c195736

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityConnecticut GI, PLLC

Victim entityConnecticut GI, PLLC

Incidentdiscovered Jun 19, 2024

Stated responseEngaged with a third-party forensic specialist to assist in conducting a comprehensive investigation

ComplianceME AG >30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov