Social EngineeringPhishingPretextingCustomer Data InvolvedIdentity (basic)Government IDFinancialMedium

Midwest Geriatric Management, LLC

bd_033cbc3f27db4aef · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Dec 14, 2020

To disclose

—

Affected

1state residents only

Linked

3 filings

Confidence

54%

Full breach record for Midwest Geriatric Management, LLC →

Midwest Geriatric Management, LLC (MGM) states that a fraudster mimicked the email account of its CFO and asked an MGM employee to email a spreadsheet, and the employee sent some of the requested information. The spreadsheet contained names, account balances (if applicable), Social Security numbers and the name of the relevant facility. MGM says a review by its IT provider found no infiltration of its systems, and it is offering 12 months of myTrueIdentity credit monitoring through TransUnion Interactive.

J jump to incidentP pin to compareR raw source

Incident timeline — partial

? — ?

Breach window unknown

Dec 14, 2020

Filed

No interval is drawn: no breach start or discovery date is on record for this filing.

This filing is one of 3 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

HHS OCRbd_0672b9fa4e2c14cb2020-12-14Verified
Indiana State AGbd_a10381e80bf828202020-12-14Verified

Name: Midwest Geriatric Management, LLC
norm: midwest geriatric management

Name: Midwest Geriatric Management, LLC
norm: midwest geriatric management

Discovered: —
Materiality determined: —
Notification sent: Dec 10, 2020
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government IDFinancial
Attack vector: Phishing
MITRE ATT&CK: T1566 Phishing
Threat actor: External

During the incident: Immediately began investigating
Contacted our IT provider to analyze the entire network and our CFO's email account
Performed other tests on the CFO's mailbox
Offering myTrueIdentity identity theft protection services through TransUnion Interactive at no cost, including 12 months of credit monitoring, unlimited TransUnion Report & Score access, and a $1,000,000 insurance reimbursement policy
Changes made: Reiterated training with the affected employee and all employees about being mindful of emails coming from outside MGM
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

HHS OCRDec 14 · first

Indiana State AGDec 14 · first

Montana State AGDec 14 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/12_17_2020_Received_Data_Breach_Notification_Sample.docx
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 14, 2020
Raw hash: 4d0c21773232945eac959e515390d71da497cc3312a5db168d4c0799faeae9cb

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityMidwest Geriatric Management, LLC

Victim entityMidwest Geriatric Management, LLC

IncidentPhishing

Stated responseImmediately began investigating

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov