SHERRILL HOUSE, INC.

Sherrill House, Inc., a skilled nursing and rehabilitation center, notified the NH Attorney General of a data breach affecting 43 NH residents. Unauthorized access to three employee email accounts occurred around Sept 4, 2021, discovered Nov 4, 2021. The incident involved phishing leading to credential compromise and email collection, exposing PHI, SSNs, financial account info, and PII. Sherrill House engaged forensic experts, secured systems, and offered 24 months of credit monitoring.

Sherrill House, Inc., a healthcare organization, reported a data breach to the Maine Attorney General, stating that an external system breach (hacking) occurred on September 4, 2021. The breach was discovered on November 4, 2021, and affected 19 Maine residents. The compromised information included names or other personal identifiers in combination with financial account numbers or credit/debit card numbers along with their security codes, access codes, passwords, or PINs. The company began notifying affected individuals on July 5, 2022, and offered two years of credit monitoring and identity theft protection services.

Sherrill House, Inc reported a data breach to the Indiana Attorney General. The breach occurred on 2021-09-04 and was reported on 2022-07-05. 1 Indiana residents were affected. 5,325 individuals affected in total.

Sherrill House, Inc. (MA) reported to HHS on 2022-01-03 a Hacking/IT Incident affecting 5,006 individuals. Multiple employees were subjects of an email phishing scheme that compromised PHI including names, gender, addresses, phone numbers, dates of birth, drivers' license and state ID numbers, Social Security numbers, financial and claims information, diagnoses, lab results, medications, and other treatment information. Breached information was located in Email. The CE notified HHS, affected individuals, and the media, and implemented additional administrative, technical, and security safeguards.

Sherrill House reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2012-08-01. 1 Massachusetts residents were affected. The report records the breach type as paper.