MisuseHealthcareTechnologyHealthcarePrivilege AbuseEmployee Data InvolvedCustomer Data InvolvedPHIHealth (basic)Government IDIdentity (basic)MediumContained

Med-data incorporated

bd_01572e11b991a8d2 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Dec 10, 2020

Filed

Apr 8, 2021

To disclose

17 weeks

Affected

12state residents only

Linked

9 filings

Confidence

66%

Full breach record for Med-data incorporated →

Med-Data, a revenue cycle services provider for healthcare systems, disclosed a security incident where a former employee saved files containing PHI (including SSNs, DOBs, and medical data) to a public website between Dec 2018 and Sep 2019. The incident was discovered on Dec 10, 2020, after a journalist alerted the company. 12 New Hampshire residents were affected. Med-Data engaged forensic specialists, removed the data, notified law enforcement and HHS, and offered credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 740 days

discovery → filing · 17 weeks / 119 days

Dec 1, 2018

Begins

Dec 10, 2020

Discovered

Apr 8, 2021

Filed

vs. sector median

+4 wks slower

This filing is one of 9 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (8) · sorted by filing gap

HHS OCRbd_14e81bc1118830f02021-04-01 · +7dVerified
Hawaii State AGbd_073059a1d70c76a32021-03-31 · +8dCandidate
Indiana State AGbd_92cf2578eac8ebec2021-03-31 · +8dVerified
Montana State AGbd_d90333e30b1f3be62021-03-31 · +8dVerified

Show 4 more filings ↓up to 99d gap

Massachusetts State AGbd_9d43a830832396952021-04-26 · +18dVerified
California State AGbd_d2fbe94657d113f02021-04-26 · +18dVerified
Oregon State AGbd_28ea87358d1eeb422021-05-05 · +27dVerified
Maine State AGbd_52a39a7ea123b7a32021-07-16 · +99dVerified

Name: Med-data incorporated
norm: med data

Name: Med-data incorporated
norm: med data
Industry: HealthcarellmTechnologyllm

Discovered: Dec 10, 2020
Breach occurred: Dec 1, 2018 – Sep 30, 2019
Undetected for: 740 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 31, 2021
Affected individuals: 12state-resident count only
Data types: PHIHealth (basic)Government IDIdentity (basic)
Attack vector: Insider
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: Internal
Regulator citations: Notified local law enforcementProvided notice to the Secretary of Health and Human Services
Initial access: insider_action

During the incident: Hired cybersecurity specialists to assist in the review of the files
Removed files from the Website
Notified local law enforcement
Provided notice to the Secretary of Health and Human Services
Sent notification letters to affected individuals
Changes made: Implemented additional security controls
Blocked all file sharing websites
Updated internal data policies and procedures
Implemented a security operations center
Deployed a managed detection and response solution that provides 24x7 monitoring
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 17 weeks(119 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 9 filings · 9 states

View merged incident ↗

Hawaii State AGMar 31 · first

Indiana State AGMar 31 · first

Montana State AGMar 31 · first

HHS OCR+1d

New Hampshire State AG+8d · this page

Massachusetts State AG+26d

California State AG+26d

Oregon State AG+35d

Maine State AG+107d

Pattern: first filing Mar 31 (HI), last Jul 16 (ME) — a 107-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/med-data-20210408.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 8, 2021
Raw hash: d991d7fdbca94b71deb89944753975582ff10e452497d99f5e5b262fef07476b

Linked disclosures

Regulatory filings (8) · sorted by filing gap

Reporting entityMed-data incorporated

Victim entityMed-data incorporated

Incidentdiscovered Dec 10, 2020

Stated responseHired cybersecurity specialists to assist in the review of the files

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov