Mt. Carmel Care Center

The Maine Office of the Attorney General disclosed that Mt. Carmel Care Center suffered a data breach caused by unauthorized external system access (hacking) between August 17, 2023, and October 15, 2023, compromising the personal and financial data of 2,375 individuals. The breach was detected on June 6, 2024, with affected parties notified via mail on August 26, 2024. The exposed information included names and financial account details, posing significant risks of identity theft, financial fraud, and reputational harm. The incident highlights vulnerabilities in the organization’s cybersecurity defenses, particularly in safeguarding sensitive financial data from external threats. The delayed discovery (nearly 8 months after the initial compromise) further exacerbates concerns about monitoring and response capabilities. Given the nature of the stolen data, affected individuals face heightened exposure to fraudulent activities, while the care center may confront regulatory scrutiny, legal liabilities, and erosion of trust among patients and stakeholders.

Source: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/dff78c62-b6c6-4559-9e05-0f943283c8b0.html

TPRM report: https://www.rankiteo.com/company/mount-carmel-care-center

"id": "mou153082025",
"linkid": "mount-carmel-care-center",
"type": "Cyber Attack",
"date": "8/2023",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"

{'affected_entities': [{'customers_affected': 2375,
                        'industry': 'Healthcare',
                        'location': 'Maine, USA',
                        'name': 'Mt. Carmel Care Center',
                        'type': 'Healthcare Facility'}],
 'attack_vector': 'External System Access (Hacking)',
 'customer_advisories': 'Written notifications mailed to affected individuals '
                        '(2024-08-26)',
 'data_breach': {'data_exfiltration': 'Yes',
                 'number_of_records_exposed': 2375,
                 'personally_identifiable_information': ['Names'],
                 'sensitivity_of_data': 'High',
                 'type_of_data_compromised': ['Personally Identifiable '
                                              'Information (PII)',
                                              'Financial Account Information']},
 'date_detected': '2024-06-06',
 'date_publicly_disclosed': '2024-08-26',
 'description': 'The Maine Office of the Attorney General reported that Mt. '
                'Carmel Care Center experienced a data breach due to external '
                'system access (hacking) occurring between August 17, 2023, '
                'and October 15, 2023, affecting 2,375 individuals. The breach '
                'was discovered on June 6, 2024, and compromised information '
                'includes names and financial account details. Notifications '
                'were mailed to affected individuals on August 26, 2024.',
 'impact': {'data_compromised': ['Names', 'Financial Account Information'],
            'identity_theft_risk': 'High (Financial Account Information '
                                   'Compromised)',
            'payment_information_risk': 'High'},
 'investigation_status': 'Disclosed; Notifications Sent',
 'references': [{'source': 'Maine Office of the Attorney General'}],
 'regulatory_compliance': {'regulatory_notifications': 'Maine Office of the '
                                                       'Attorney General'},
 'response': {'communication_strategy': 'Written notifications mailed to '
                                        'affected individuals'},
 'title': 'Mt. Carmel Care Center Data Breach (2023-2024)',
 'type': 'Data Breach'}