HackingHealthcareHealthcareCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Government IDPHIHealth (basic)MediumContained

Hendry County Hospital Authority

bd_f8877c4a794b8b26 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 25, 2022

Filed

Mar 12, 2024

To disclose

19 months

Affected

Not disclosed

Linked

4 filings

Confidence

68%

Full breach record for Hendry County Hospital Authority →2 incidents on file

Hendry Regional Medical Center (Florida) detected unauthorized access to its network on August 25, 2022. An external party gained temporary access, potentially exposing patient data including names, addresses, dates of birth, SSNs, medical information, and phone numbers. The organization secured the network, engaged forensic investigators, and implemented security enhancements such as password resets and firewall updates. Substitute notice was provided on the website in February 2023, followed by direct mail notices in March 2024. Credit monitoring services were offered to affected individuals.

J jump to incidentP pin to compareR raw source

Vermont clock✗ VT AG >45 bday19 months discovery → filing

Incident timeline

discovery → filing · 19 months / 565 days

Aug 25, 2022

Discovered

Mar 12, 2024

Filed

vs. sector median

+68 wks slower

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Massachusetts State AGbd_4e90cb2ff0a48dfd2024-03-12Verified
Montana State AGbd_8923030a8d5ead8a2024-03-12Candidate
Indiana State AGbd_e9923a0f6e593e5e2024-03-12Verified

Name: Hendry County Hospital Authority
norm: hendry county hospital authority

Name: Hendry County Hospital Authority
norm: hendry county hospital authority
Also named: Hendry County Hospital Authoritydba oflegal entity
Hendry Regional Medical Centerdba oftrade name
Industry: Healthcarellm

Discovered: Aug 25, 2022
Materiality determined: —
Notification sent: Mar 12, 2024
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDPHIHealth (basic)
Data elements: Social Security numberDate of birthMedical information
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External

During the incident: Moved quickly to secure our network environment
Launched a thorough investigation
Engaged external IT specialists to determine the scope and extent of the potential unauthorized access
Performed data mining on the affected systems to identify the specific individuals and the types of information that may have been compromised
Proceeded with substitute notice which has been available on our website since February, 2023
Changes made: Implementing additional safeguards and enhanced security measures to better protect the privacy and security of information in our systems
Changing all passwords
Updating our firewall and VPN
Reviewed and taken steps to enhance our policies and procedures relating to the security of our systems and servers
Enhanced our information life cycle management
Providing access to Single Bureau Credit Monitoring/Single Bureau Credit Report/Single Bureau Credit Score services at no charge for twelve (12) months
Providing proactive fraud assistance
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 19 months(565 days from discovery to filing)
Compliance flags: VT AG >45 bday
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Massachusetts State AGMar 12 · first

Montana State AGMar 12 · first

Indiana State AGMar 12 · first

Vermont State AGMar 12 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ago.vermont.gov/document/2024-03-12-hendry-regional-medical-center-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 12, 2024
Raw hash: 149ed5baa39d397541e83f4d8ba79f84ab3249a47de00b34e9a08527f2233b56

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityHendry County Hospital Authority

Victim entityHendry County Hospital Authority

Incidentdiscovered Aug 25, 2022

Stated responseMoved quickly to secure our network environment

ComplianceVT AG >45 bday

Extraction provenanceno artifact recorded

Source provenanceago.vermont.gov