Montana Department of Public Health & Human Services

Montana Department of Public Health and Human Services notified the New Hampshire Attorney General regarding a breach affecting approximately 1.3 million individuals. Hackers gained access to a server in June 2013 and remained undetected until May 15, 2014. The incident involved malware that encrypted data and exfiltrated PHI, including diagnoses, prescriptions, SSNs, and financial account numbers. The agency shut down the server, upgraded security, and offered credit monitoring.

Affected (this filing): 1,300,000

Montana Department of Public Health and Human Services reported to HHS on 2014-07-07 a Hacking/IT Incident affecting 1,062,509 individuals. Breached information located on a Network Server. The incident involved an undetected and unpatched application code vulnerability exploited for approximately 9 months, exposing demographic, clinical, and/or financial information. Upon discovery, the server was taken offline, law enforcement was notified, a forensics investigation was conducted, and OCR provided technical assistance. Credit monitoring was offered to affected individuals.

Affected (this filing):