MisuseHealthcareRetail & ConsumerHealthcarePrivilege AbuseEmployee Data InvolvedCustomer Data InvolvedIdentity (basic)Health (basic)PHILowContained

United States Medical Supply, LLC.

bd_06d242f75967daba · schema v1 · pii pii-v1

Severity

Low

Discovered

Nov 13, 2023

Filed

Jan 24, 2024

To disclose

10 weeks

Affected

1state residents only

Linked

5 filings

Confidence

66%

Full breach record for United States Medical Supply, LLC. →2 incidents on file

United States Medical Supply notified Montana residents of a data breach where an internal employee allowed an unauthorized individual to access customer telephone conversations. The incident, discovered on November 13, 2023, exposed names, contact info, DOB, and sensitive health information. The employee was terminated, and affected individuals were offered 24 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 10 weeks / 72 days

Nov 13, 2023

Discovered

Jan 24, 2024

Filed

vs. sector median

1 wks faster

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

New Hampshire State AGbd_d0fcf7a397b6a25f2024-01-24Verified
Massachusetts State AGbd_e1cbd2af870c0d982024-01-24Verified
Vermont State AGbd_6eac3fe32c901ea42024-01-12 · +12dCandidate
Indiana State AGbd_ffd43de97bfefcf82024-01-12 · +12dVerified

Name: United States Medical Supply, LLC.
norm: united states medical supply

Name: United States Medical Supply, LLC.
norm: united states medical supply
Industry: HealthcarellmRetail & Consumerllm

Discovered: Nov 13, 2023
Materiality determined: —
Notification sent: Jan 12, 2024
Affected individuals: 1state-resident count only
Data types: Identity (basic)Health (basic)PHI
Attack vector: Insider
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: Internal
Initial access: insider_action

During the incident: Severed the employee’s access to US MED customer information
Terminated the employee
Conducted a thorough investigation
Offering complimentary access to Experian IdentityWorks for 24 months
Changes made: Reviewing security policies and procedures
Reviewing employee policy and procedures
Reviewing employee training procedures
Reviewing work from home procedures
Updating all policies, procedures, and training
Flagged patient IDs so that any activity related to you and any access to your information will only be handled by senior personnel
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 10 weeks(72 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Vermont State AGJan 12 · first

Indiana State AGJan 12 · first

New Hampshire State AG+12d

Massachusetts State AG+12d

Montana State AG+12d · this page

Pattern: first filing Jan 12 (VT), last Jan 24 (MT) — a 12-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-notification-letter-1049.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 24, 2024
Raw hash: 8b5d6ba699f425276eb29bedcc6cb84665c8b6edc469c21535cd6204b46efba0

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityUnited States Medical Supply, LLC.

Victim entityUnited States Medical Supply, LLC.

Incidentdiscovered Nov 13, 2023

Stated responseSevered the employee’s access to US MED customer information

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov