MalwareHealthcareHealthcareRansomwarePhishingData EncryptedCustomer Data InvolvedGovernment IDIdentity (basic)MediumContained

SUNMED GROUP HOLDINGS, LLC

bd_090a534a2bad3b77 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Oct 11, 2020

Filed

Mar 19, 2021

To disclose

23 weeks

Affected

Not disclosed

Linked

4 filings

Confidence

65%

Full breach record for SUNMED GROUP HOLDINGS, LLC →

SunMed Group Holdings, LLC experienced a ransomware incident on October 11, 2020, likely initiated via a phishing email link clicked by an employee. The attack encrypted server files. The company contained the threat, restored operations, and engaged external cybersecurity professionals and law enforcement. On February 21, 2021, the company determined that personal information, including Social Security numbers, may have been acquired by the threat actor. Affected individuals were offered one year of complimentary credit monitoring.

J jump to incidentP pin to compareR raw source

California clockDiscovered Oct 11, 2020 → Notified Feb 21, 2021133d ✗ CA 60-day late23 weeks discovery → filing

Incident timeline

discovery → filing · 23 weeks / 159 days

Oct 11, 2020

Begins

Oct 11, 2020

Discovered

Mar 19, 2021

Filed

vs. sector median

+12 wks slower

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Massachusetts State AGbd_f227211a4f5d91772021-03-19Verified
Indiana State AGbd_fff893c7b6d647752021-03-18 · +1dVerified
New Hampshire State AGbd_e6eadc52efd13f282021-03-22 · +3dCandidate

Name: SUNMED GROUP HOLDINGS, LLC
norm: sunmed group

Name: SUNMED GROUP HOLDINGS, LLC
norm: sunmed group
Industry: Healthcarellm

Discovered: Oct 11, 2020
Breach occurred: Oct 11, 2020 – Oct 11, 2020
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 21, 2021
Affected individuals: Not disclosed
Data types: Government IDIdentity (basic)
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1566.002 Spearphishing Link
Threat actor: ExternalFinancial
Regulator citations: Notified law enforcement
Initial access: phishing_link

During the incident: Contained the threat
Commenced a thorough investigation
Working very closely with external cybersecurity professionals experienced in handling these types of incidents
Working with law enforcement
Restored the system so that we could resume operations
Changes made: Continue to fortify our security measures to help prevent future cyber security threats
Continually evaluate and modify our practices and internal controls to enhance the security and privacy of your personal information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 23 weeks(159 days from discovery to filing)
Compliance flags: CA 60-day late · 133d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Oct 11, 2020
→ Notified: Feb 21, 2021
133d 60 days (analyst band, pre-2026 discoveries) CA 60-day late

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Oct 11, 2020 → Notified: Feb 21, 2021	133d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Indiana State AGMar 18 · first

Massachusetts State AG+1d

California State AG+1d · this page

New Hampshire State AG+4d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-539296
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 19, 2021
Raw hash: d7f1d23a24b1616797d7c9e153df8eaf322831418e66cb2acc0fa283e3f73ad9

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entitySUNMED GROUP HOLDINGS, LLC

Victim entitySUNMED GROUP HOLDINGS, LLC

Incidentdiscovered Oct 11, 2020

Stated responseContained the threat

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov