Cyber Incident Victim: NuLife Med
Date:
Mar 2022
Location:
United States of America
Summary
A New Hampshire-based medical device company experienced a data security incident involving unauthorized access to its systems, potentially compromising personal and sensitive information of over 81,000 individuals. The breach exposed names, medical and treatment details, health insurance data, addresses, financial account information, Social Security numbers, and driver’s license numbers. The organization detected the incident promptly, initiated an investigation, and secured its systems, though it could not definitively identify all accessed files. No evidence of identity theft or fraud stemming from the event was found at the time of disclosure. The company emphasized its commitment to safeguarding information and implemented measures to address the breach.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 3 techniques |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
NuLife Med, a New Hampshire-based veteran-owned medical device company, experienced a data security incident impacting 81,244 individuals. The company discovered unauthorized access to its systems on March 11, 2022, and subsequent investigation revealed the intrusion occurred between March 9 and March 11. While NuLife Med could not definitively confirm the exact files accessed or acquired by the unauthorized actor beyond a limited number, the compromised data potentially included names, medical information, health insurance details, addresses, Social Security numbers, financial account information, and driver’s license numbers. The company emphasized its serious approach to the incident and the security of affected information in a public notice. As of May 9, 2022, NuLife Med reported no evidence of identity theft or fraud stemming from the breach.
Upon detecting the incident, NuLife Med initiated a rapid response that included launching an investigation, assessing system security, and identifying compromised data. The company did not disclose specific technical containment measures, system vulnerabilities, or whether law enforcement was involved. Its public communication focused on acknowledging the event, outlining the types of potentially exposed data, and reiterating its commitment to information security. No mention was made of offering credit monitoring or identity protection services to affected individuals. The incident’s operational impact on NuLife Med’s business functions or device manufacturing processes was not detailed in the available information.