HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of April 21, 2017.
- Organization as reported
- Behavioral Health Center, ME
- Entity type as reported
- Healthcare Provider
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Network Server
- Submission date
- April 21, 2017
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14212, row:5351)
- Archived copy
- Held in the private archive (provenance)
Behavioral Health Center of Bangor, Maine, the covered entity (CE) reported that a hacker accessed the CE’s terminal server and obtained the protected health information (PHI) of 4,229 individuals. The CE reported that the PHI was advertised for sale on AlphaBay, a darknet market place on the Tor Network. The types of PHI included names, services provided and clinical information, addresses, dates of birth, social security numbers and phone numbers. The CE provided breach notification to HHS, affected individuals (including providing one year of triple bureau credit monitoring services), and the media. The CE also contacted the FBI, three consumer reporting agencies, and the Maine Attorney General. As a result of the incident, the CE implemented safeguards that addressed vulnerabilities that were exploited in the incident, disabled a remote server, applied audit controls standards, implemented policies and procedures to guard against malicious software, and adopted an Integrity controls policy. Finally, the CE notified OCR that they were closing their office in 2018.