HackingHealthcareProfessional ServicesHealthcareSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedDownstream VictimsIdentity (basic)Government IDHealth (basic)MediumContained

Select Sport

bd_f716fd72481985a8 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 11, 2024

Filed

Jun 6, 2025

To disclose

47 weeks

Affected

214state residents only

Confidence

65%

Full breach record for Select Sport →

Select Medical Holdings, Inc. notified the NH AG of a data breach at former vendor Nationwide Recovery Services (NRS). Unauthorized access occurred July 5-11, 2024, resulting in exfiltration of patient/guarantor PII (names, DOB, SSN, health info). NRS discovered the incident on July 11, 2024. Select notified 214 NH residents on June 6, 2025, offering credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 6 days

discovery → filing · 47 weeks / 330 days

Jul 5, 2024

Begins

Jul 11, 2024

Discovered

Feb 3, 2025

Scope determined

Jun 6, 2025

Filed

vs. sector median

+36 wks slower

Part of Nationwide Recovery Services, Inc. supply-chain incident (2025) — a supply-chain cascade affecting multiple organizations.View cascade →

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed214 affectedView incident

Name: Select Medical Holdings Corporation
norm: select medical

Name: Select Sport
norm: select sport
Domain: us.select-sport.com
Industry: HealthcarellmProfessional Servicesllm

Discovered: Jul 11, 2024
Breach occurred: Jul 5, 2024 – Jul 11, 2024
Undetected for: 6 daysoccurrence → discovery
Materiality determined: Feb 3, 2025
Notification sent: Jun 6, 2025
Affected individuals: 214state-resident count only
Data types: Identity (basic)Government IDHealth (basic)
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: Reported incident to law enforcementNotified New Hampshire Attorney General
Third party: via Nationwide Recovery Services, Inc.vendor

During the incident: NRS immediately took steps to secure its environment
Launched an investigation to determine the nature and scope of the activity
Reported this incident to law enforcement
Conducted an extensive review of these files
Select has terminated its contract with NRS
Select has established a dedicated, toll-free incident response line
Offering complimentary memberships to credit monitoring
Changes made: NRS reviewed existing security policies
Implemented additional measures to further protect against similar incidents moving forward
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 47 weeks(330 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/select-medical-holdings-20250606.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 6, 2025
Raw hash: 3b7e9586f226b5b09ee79ed258671adee9ee728f4bacbc5810a2f9985f495beb

Reporting entitySelect Medical Holdings Corporation

Victim entitySelect Sport

Incidentdiscovered Jul 11, 2024

Stated responseNRS immediately took steps to secure its environment

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov