AccidentalHealthcareHealthcareMisconfigurationData ExfiltratedCustomer Data InvolvedPHIHealth (basic)Financial accountIdentity (basic)LowContained

Sunshine Behavioral Health Group LLC

bd_f405caed3608eb7e · schema v1 · pii pii-v1

Severity

Low

Discovered

Sep 4, 2019

Filed

Jan 22, 2020

To disclose

20 weeks

Affected

13state residents only

Linked

6 filings

Confidence

67%

Full breach record for Sunshine Behavioral Health Group LLC →4 incidents on file

Sunshine Behavioral Health Group, LLC notified the NH AG of a privacy incident where a cloud-based system storing patient records was inadvertently made publicly accessible on the internet. Discovered Sept 4, 2019, the breach affected PHI and payment info of 13 NH residents. Sunshine remediated access controls and offered 2 years of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 20 weeks / 140 days

Sep 4, 2019

Discovered

Jan 22, 2020

Filed

vs. sector median

+9 wks slower

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Montana State AGbd_3d7e1743638739702020-01-21 · +1dVerified
California State AGbd_aeade4f412fb254a2020-01-21 · +1dVerified
Massachusetts State AGbd_e7a7986b491216d62020-01-21 · +1dVerified
Illinois State AGbd_e61a26608ca271172020-01-01 · +21dCandidate

Show 1 more filing ↓up to 51d gap

HHS OCRbd_d832951031a15b4d2019-12-02 · +51dCandidate

Name: Sunshine Behavioral Health Group LLC
norm: sunshine behavioral health

Name: Sunshine Behavioral Health Group LLC
norm: sunshine behavioral health
Industry: Healthcarellm

Discovered: Sep 4, 2019
Materiality determined: —
Notification sent: Jan 22, 2020
Affected individuals: 13state-resident count only
Data types: PHIHealth (basic)Financial accountIdentity (basic)
Attack vector: Misconfiguration
MITRE ATT&CK: T1074 Data Staged
Regulator citations: Notified New Hampshire Attorney General

During the incident: Immediately took steps to change the settings
Took additional actions to remove the records from general Internet access
Began an investigation to identify any potentially affected individuals
Modified access controls for the affected system
Reviewed its company policies and procedures relating to the security and privacy of patient records
Providing affected individuals with notification of the incident
Contracted with ID Experts to provide two years of membership in the MyIDCare service at no cost to all confirmed affected individuals
Changes made: Modified access controls for the affected system
Reviewed its company policies and procedures relating to the security and privacy of patient records
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 20 weeks(140 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 5 states

View merged incident ↗

HHS OCRDec 2 · first

Illinois State AG+30d

Montana State AG+50d

California State AG+50d

Massachusetts State AG+50d

New Hampshire State AG+51d · this page

Pattern: first filing Dec 2 (CA), last Jan 22 (NH) — a 51-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/sunshine-behavioral-health-20200122.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 22, 2020
Raw hash: 7dc959e75ee8e3e05e7267d5ca6c3480ca8f147cff1b48b0e47413bb5f7ef128

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entitySunshine Behavioral Health Group LLC

Victim entitySunshine Behavioral Health Group LLC

Incidentdiscovered Sep 4, 2019

Stated responseImmediately took steps to change the settings

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov