HackingHealthcareHealthcareStolen CredentialsData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDFinancial accountHealth (basic)MediumContained

North American Spine Society

bd_046df94685f0b61a · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 13, 2022

Filed

Jul 8, 2022

To disclose

21 weeks

Affected

36state residents only

Linked

5 filings

Confidence

66%

Full breach record for North American Spine Society →

The North American Spine Society (NASS) reported a cybersecurity incident discovered on Feb 13, 2022, involving unauthorized access to its servers. While forensics were inconclusive on data acquisition, NASS notified 36 NH residents out of caution. Data potentially exposed included PII, SSN, financial info, and medical IDs. NASS rebuilt systems from backups and offered credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 21 weeks / 145 days

Feb 13, 2022

Begins

Feb 13, 2022

Discovered

Jul 8, 2022

Filed

vs. sector median

+8 wks slower

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Massachusetts State AGbd_0ad0850e5d804e912022-07-08Verified
Montana State AGbd_309247a9741651ef2022-07-08Verified
Maine State AGbd_90758749d3adcd7b2022-07-08Verified
Indiana State AGbd_fab8d17ceaaaf4c72022-07-08Verified

Name: Wilson, Elser, Moskowitz, Edelman & Dicker LLP
norm: wilson elser moskowitz edelman dicker
Domain: wilsonelser.com

Name: North American Spine Society
norm: north american spine society
Industry: Healthcarellm

Discovered: Feb 13, 2022
Breach occurred: Feb 13, 2022
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 8, 2022
Affected individuals: 36state-resident count only
Data types: Identity (basic)Government IDFinancial accountHealth (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney General
Initial access: valid_credentials

During the incident: Engaged a team of cyber security professionals to assist with the recovery of its business services
Conducted a forensic investigation to determine the scope and the overall impact of the incident
Notified all potentially affected individuals
Deleted all of the systems and rebuilt from the nearest set of backups that were scanned and shown as unaffected
Offered 12 months of complimentary credit monitoring and identity theft restoration services through Cyberscout
Changes made: Deleted all of the systems and rebuilt from the nearest set of backups that were scanned and shown as unaffected
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 21 weeks(145 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Massachusetts State AGJul 8 · first

Montana State AGJul 8 · first

Maine State AGJul 8 · first

Indiana State AGJul 8 · first

New Hampshire State AGJul 8 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/wilson-elser-moskowitz-edelman-dicker-20220708.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 8, 2022
Raw hash: 6231fe2bf7aeb26800f82b5056a782c4a6f6161ded219d99116b17c722751d1f

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityWilson, Elser, Moskowitz, Edelman & Dicker LLP

Victim entityNorth American Spine Society

Incidentdiscovered Feb 13, 2022

Stated responseEngaged a team of cyber security professionals to assist with the recovery of its business services

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov