HackingHealthcareTechnologyHealthcareCustomer Data InvolvedEmployee Data InvolvedPHIHealth (basic)Identity (basic)Government IDCredentialsMediumActive

Medical Informatics Engineering, LLC

bd_09ef90b2209ecb87 · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 26, 2015

Filed

Jun 26, 2015

To disclose

4 weeks

Affected

Not disclosed

Linked

6 filings

Confidence

64%

Full breach record for Medical Informatics Engineering, LLC →2 incidents on file

Medical Informatics Engineering and its subsidiary NoMoreClipboard experienced a sophisticated cyber attack resulting in unauthorized access to their networks between May 7 and May 8, 2015, with additional access on May 25, 2015. The incident was discovered on May 26, 2015. Compromised data includes protected health information (PHI) such as names, addresses, dates of birth, Social Security numbers, lab results, and medical conditions. No financial or credit card information was compromised. The company engaged forensic experts, notified the FBI, and is offering 24 months of credit monitoring to affected individuals. The investigation is ongoing.

J jump to incidentP pin to compareR raw source

California clockDiscovered May 26, 2015 → Notified Jun 2, 20157d ✓ CA 60-day OK4 weeks discovery → filing

Incident timeline

undetected · 19 days

discovery → filing · 4 weeks / 31 days

May 7, 2015

Begins

May 26, 2015

Discovered

Jun 26, 2015

Filed

vs. sector median

8 wks faster

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

South Carolina State AGbd_2fa58541856deea52015-06-24 · +2dVerified
Massachusetts State AGbd_85c12c459cf35bf22015-06-23 · +3dVerified
New Hampshire State AGbd_b69401d90d3e78842015-07-15 · +19dVerified
HHS OCRbd_c89bcf483c5d09e42015-07-23 · +27dCandidate

Show 1 more filing ↓up to 1427d gap

HHS OCR enforcementbd_f7b328d96e972d202019-05-23 · +1427dVerified by operator

Name: Medical Informatics Engineering, LLC
norm: medical informatics engineering
Domain: mieweb.com

Name: Medical Informatics Engineering, LLC
norm: medical informatics engineering
Domain: mieweb.com
Industry: HealthcarellmTechnologyllm

Discovered: May 26, 2015
Breach occurred: May 7, 2015 – May 8, 2015
Undetected for: 19 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 2, 2015
Affected individuals: Not disclosed
Data types: PHIHealth (basic)Identity (basic)Government IDCredentials
Data elements: Social Security numberDate of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Reported incident to the FBI Cyber SquadDisclosing incident to certain state and federal regulators

During the incident: Initiated Incident Response Plan
Engaged independent third-party forensics experts
Reported incident to the FBI Cyber Squad
Cooperating with law enforcement's investigation
Established a toll-free call center to answer questions
Offering credit monitoring and identity protection services to affected patients, free of charge, for the next 24 months
Prompting password change for NoMoreClipboard users
Changes made: Working to identify and remediate any identified security vulnerability
Reviewing security practices to enhance the security of protected health information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 4 weeks(31 days from discovery to filing)
Compliance flags: CA 60-day OK · 7d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: May 26, 2015
→ Notified: Jun 2, 2015
7d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: May 26, 2015 → Notified: Jun 2, 2015	7d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 5 states

View merged incident ↗

Massachusetts State AGJun 23 · first

South Carolina State AG+1d

California State AG+3d · this page

New Hampshire State AG+22d

HHS OCR+30d

HHS OCR enforcement+1430d

Pattern: first filing Jun 23 (MA), last May 23 — a 1430-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-56609
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 26, 2015
Raw hash: f2b29b8e95cf510d2c668239c0af7340f68645e766383c602e9b7e071f93fcd8

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityMedical Informatics Engineering, LLC

Victim entityMedical Informatics Engineering, LLC

Incidentdiscovered May 26, 2015

Stated responseInitiated Incident Response Plan

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov