HackingHealthcareHealthcareCustomer Data InvolvedPIIIdentity (basic)Government IDMediumContained

Best Health Physical Therapy, LLC

bd_fe16e8847c50c68c · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 26, 2024

Filed

Jun 10, 2024

To disclose

15 weeks

Affected

13state residents only

Linked

5 filings

Confidence

66%

Full breach record for Best Health Physical Therapy, LLC →2 incidents on file

Best Health Physical Therapy, LLC notified the NH AG of a data security incident discovered on Feb 26, 2024. An unauthorized actor may have accessed patient data. 13 NH residents affected. Notification letters sent May 10, 2024. Identity monitoring provided via CyEx.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 15 weeks / 105 days

Feb 26, 2024

Discovered

Jun 10, 2024

Filed

vs. sector median

+3 wks slower

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

HHS OCRbd_d486c24d47095fca2024-06-06 · +4dVerified
Massachusetts State AGbd_c24cc54198371cbd2024-06-17 · +7dVerified
Maine State AGbd_b2c8f910f45ec7102024-05-23 · +18dCandidate
Indiana State AGbd_d16224ac71ea4c932024-05-10 · +31dVerified

Name: Best Health Physical Therapy, LLC
norm: best health physical therapy

Name: Best Health Physical Therapy, LLC
norm: best health physical therapy
Industry: Healthcarellm

Discovered: Feb 26, 2024
Materiality determined: —
Notification sent: May 10, 2024
Affected individuals: 13state-resident count only
Data types: PIIIdentity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified New Hampshire Department of Justice Office of the Attorney General

During the incident: Retained a leading forensics firm to investigate and assess the security of its systems
Took steps to secure and monitor its environment
Reported the incident to law enforcement
Sent notification letters to the thirteen (13) New Hampshire residents
Secured the services of CyEx to provide identity monitoring services
Changes made: Secured and monitored its environment
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 15 weeks(105 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Indiana State AGMay 10 · first

Maine State AG+13d

HHS OCR+27d

New Hampshire State AG+31d · this page

Massachusetts State AG+38d

Pattern: first filing May 10 (IN), last Jun 17 (MA) — a 38-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/best-health-physical-therapy-20240610.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 10, 2024
Raw hash: 9c59d339930199f475b33f539a867a9638e1c3c143d0e6f80db9424c2794ffd1

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityBest Health Physical Therapy, LLC

Victim entityBest Health Physical Therapy, LLC

Incidentdiscovered Feb 26, 2024

Stated responseRetained a leading forensics firm to investigate and assess the security of its systems

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov