HackingHealthcareHealthcareSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)Health (basic)PHILowContained

Sight Partners Physicians, P.C.

bd_04b226a35edaf020 · schema v1 · pii pii-v1

Severity

Low

Discovered

Apr 15, 2022

Filed

Jun 14, 2022

To disclose

9 weeks

Affected

86state residents only

Linked

3 filings

Confidence

64%

Full breach record for Sight Partners Physicians, P.C. →2 incidents on file

Sight Partners Physicians, P.C. notified patients of a cyber-attack on its former EHR vendor, Eye Care Leaders, occurring on or about Dec 4, 2021. Patient PII and PHI (name, DOB, medical info) may have been accessed. Sight Partners notified HHS and offered credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 132 days

discovery → filing · 9 weeks / 60 days

Dec 4, 2021

Begins

Apr 15, 2022

Discovered

Jun 14, 2022

Filed

vs. sector median

2 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Washington State AGbd_06e8576ba3ddca272022-06-14Verified by operator
HHS OCRbd_4aa534e7734644262022-06-14Verified

Name: Sight Partners Physicians, P.C.
norm: sight partners physicians

Name: Sight Partners Physicians, P.C.
norm: sight partners physicians
Industry: Healthcarellm

Discovered: Apr 15, 2022
Breach occurred: Dec 4, 2021
Undetected for: 132 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 14, 2022
Affected individuals: 86state-resident count only
Data types: Identity (basic)Health (basic)PHI
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain Compromise
Threat actor: External
Regulator citations: Notified U.S. Department of Health and Human Services
Third party: via Eye Care Leaders

During the incident: Notified appropriate governmental regulators, including the U.S. Department of Health and Human Services
Notified potentially impacted patients
Offering complimentary identity and credit monitoring services through Experian
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(60 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 2 states

View merged incident ↗

Washington State AGJun 14 · first

HHS OCRJun 14 · first

Montana State AGJun 14 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-Notification-75.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 14, 2022
Raw hash: c3ae15de81214eb31e2817dda46df42d28ec0e2a0053bac3959e7b90b384b6a9

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entitySight Partners Physicians, P.C.

Victim entitySight Partners Physicians, P.C.

Incidentdiscovered Apr 15, 2022

Stated responseNotified appropriate governmental regulators, including the U.S. Department of Health and Human Services

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov