CRG Lynwood, LLC

CRG Lynwood, LLC d/b/a Lynwood Manor notified the NH AG of a cybersecurity incident involving its third-party administrator, Excelerate Healthcare Services (EHS). The incident occurred in July 2021, but Lynwood did not learn of the potential impact on patient information until September 2022. The breach exposed PII, including names and addresses. Lynwood engaged forensic investigators, deployed monitoring tools, and offered credit monitoring services to affected individuals.

CRG Lynwood, LLC (d/b/a Lynwood Manor), a healthcare entity based in Michigan, reported an external system breach (hacking) occurring on July 12, 2021. The incident compromised the personal information of 6,566 individuals, including 1 Maine resident. Acquired data included names combined with driver's license numbers. The entity notified affected individuals in writing on June 7, 2024, and offered identity theft protection services.

Affected (this filing): 6,566

CRG Lynwood, LLC d/b/a Lynwood Manor (a Michigan healthcare provider) reported to HHS OCR that its business associate experienced a ransomware attack affecting PHI of 6,566 individuals. Affected data included names, dates of birth, driver's license numbers, Social Security numbers, claims and financial information, medications, and other treatment information stored on a network server. The covered entity notified HHS, affected individuals, and the media; provided substitute notice and complimentary credit monitoring; and implemented additional administrative, technical, and security safeguards plus workforce retraining.