HackingProfessional ServicesEducationProfessional ServicesStolen CredentialsCapture Stored DataData ExfiltratedCustomer Data InvolvedPCIFinancial accountFinancial credentialsIdentity (basic)LowContained

American Society for Clinical Pathology

bd_0068d4a7a36ff7b7 · schema v1 · pii pii-v1

Severity

Low

Discovered

Mar 11, 2021

Filed

Apr 7, 2021

To disclose

27 days

Affected

703state residents only

Linked

8 filings

Confidence

69%

Full breach record for American Society for Clinical Pathology →

American Society for Clinical Pathology (ASCP) notified Washington AG of a cyberattack targeting its e-commerce website. Unauthorized access occurred between March 30 and November 6, 2020, potentially exposing payment card data (names, card numbers, CVVs) for 703 Washington residents. ASCP engaged forensic investigators, resolved the vulnerability, and implemented additional security safeguards. No evidence of misuse was found.

J jump to incidentP pin to compareR raw source

Washington clock✓ WA AG ≤30d27 days discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 346 days

discovery → filing · 27 days

Mar 30, 2020

Begins

Mar 11, 2021

Discovered

Apr 7, 2021

Filed

vs. sector median

14 wks faster

This filing is one of 8 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (7) · sorted by filing gap

California State AGbd_50dbb9c8e5101fcf2021-04-07Verified
Massachusetts State AGbd_ae4d677d9170ca6d2021-04-07Verified
Maine State AGbd_cb2b3e87c8a69a2e2021-04-07Verified by operator
New Hampshire State AGbd_1c56d6fdb347f2912021-04-12 · +5dVerified

Show 3 more filings ↓up to 34d gap

Montana State AGbd_2e4a4fe0820ab0af2021-04-01 · +6dCandidate
Indiana State AGbd_8246d19f98183f762021-04-01 · +6dVerified
Oregon State AGbd_1a1b74d201b159d82021-05-11 · +34dVerified by operator

Name: MCDONALD HOPKINS LLC
norm: mcdonald hopkins

Name: American Society for Clinical Pathology
norm: american society for clinical pathology
Domain: ascp.org
Industry: Professional ServicesllmEducationllm

Discovered: Mar 11, 2021
Breach occurred: Mar 30, 2020 – Nov 6, 2020
Undetected for: 346 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 1, 2021
Affected individuals: 703state-resident count only
Data types: PCIFinancial accountFinancial credentialsIdentity (basic)
Data elements: NameFinancial account number
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 300-399dexposure 200-299d
WA-stated discovery: Found after the fact
Attack vector: Ransomware
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified Washington Attorney General Consumer Protection Division
Initial access: exploit_public_facing

During the incident: Engaged external forensic investigators and data privacy professionals
Conducted a thorough investigation into the incident
Provided the affected residents with written notification
Advised affected residents about the process for placing fraud alerts and/or security freezes
Advised affected residents to review their financial account statements for fraudulent or irregular activity
Changes made: Resolved the issue that led to the potential exposure on the website
Implemented additional security safeguards to protect against future intrusions
Continues ongoing intensive monitoring of its website
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 27 days(27 days from discovery to filing)
Compliance flags: WA AG ≤30d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 8 states

View merged incident ↗

Montana State AGApr 1 · first

Indiana State AGApr 1 · first

California State AG+6d

Massachusetts State AG+6d

Maine State AG+6d

Washington State AG+6d · this page

New Hampshire State AG+11d

Oregon State AG+40d

Pattern: first filing Apr 1 (MT), last May 11 (OR) — a 40-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10441.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 7, 2021
Raw hash: b71f599972fde0668571f23beb524687bc7ff5f3b5992d09d53dc71a49cc209b

Linked disclosures

Regulatory filings (7) · sorted by filing gap

Reporting entityMCDONALD HOPKINS LLC

Victim entityAmerican Society for Clinical Pathology

Incidentdiscovered Mar 11, 2021

Stated responseEngaged external forensic investigators and data privacy professionals

ComplianceWA AG ≤30d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com