HackingHealthcareHealthcareCustomer Data InvolvedPIIIdentity (basic)Government IDMediumContained

Albany ENT & Allergy Services, PC.

bd_0a6eaa1408125771 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 27, 2023

Filed

May 25, 2023

To disclose

8 weeks

Affected

10state residents only

Linked

10 records

Confidence

64%

Full breach record for Albany ENT & Allergy Services, PC. →

Albany ENT & Allergy Services, PC notified patients of unauthorized network access occurring between March 23 and April 4, 2023. Suspicious activity was detected on March 27, 2023. Patient PII and government IDs were potentially accessed. The company engaged forensic specialists and offered Kroll identity monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 4 days

discovery → filing · 8 weeks / 59 days

Mar 23, 2023

Begins

Mar 27, 2023

Discovered

May 25, 2023

Filed

vs. sector median

1 wks faster

This filing is one of 10 records about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (2)

Leak Sitebianlianbd_bb7450067adcff262023-05-11 · +14dVerified by operator
Leak Siteransomhousebd_939207285c72f9612023-04-28 · +27dVerified by operator

Regulatory filings (7) · sorted by filing gap

Massachusetts State AGbd_5e4becc9a824e4e72023-05-25Verified
Maine State AGbd_61a655489dcec50c2023-05-25Verified
Maine State AGbd_834e34dced3346ea2023-05-25Verified
HHS OCRbd_9c9e04dcea02fe822023-05-25Verified

Show 3 more filings ↓up to 144d gap

Indiana State AGbd_ee3947b080d2f8222023-05-25Verified
New Hampshire State AGbd_a76fe1a1827012532023-05-31 · +6dVerified
Illinois State AGbd_ecd2619c523e95ca2023-01-01 · +144dCandidate

Name: Albany ENT & Allergy Services, PC.
norm: albany ent allergy
Domain: albanyentandallergy.com

Name: Albany ENT & Allergy Services, PC.
norm: albany ent allergy
Domain: albanyentandallergy.com
Industry: Healthcarellm

Discovered: Mar 27, 2023
Breach occurred: Mar 23, 2023 – Apr 4, 2023
Undetected for: 4 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 10state-resident count only
Data types: PIIIdentity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Will notify applicable regulatory authorities, as required by law
Initial access: valid_credentials

During the incident: Launched an investigation with the assistance of third-party computer forensic specialists
Confirming the security of our systems
Reviewing the contents of relevant data for sensitive information
Notifying impacted individuals associated with that sensitive information
Offering complimentary access to identity monitoring services through Kroll
Changes made: Reviewing our existing policies and procedures
Providing additional training to employees
Implementing additional safeguards to further secure information in our systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(59 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 7 states

View merged incident ↗

Illinois State AGJan 1 · first

Massachusetts State AG+144d

Maine State AG+144d

HHS OCR+144d

Indiana State AG+144d

Montana State AG+144d · this page

New Hampshire State AG+150d

Pattern: first filing Jan 1 (IL), last May 31 (NH) — a 150-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-notification-letter-316.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 25, 2023
Raw hash: 2fda7268905528223519682ba90271af8cdea4211a663b776a5f56bf6b4aca3e

Linked disclosures

Ransomware claims (2)

Regulatory filings (7) · sorted by filing gap

Reporting entityAlbany ENT & Allergy Services, PC.

Victim entityAlbany ENT & Allergy Services, PC.

Incidentdiscovered Mar 27, 2023

Stated responseLaunched an investigation with the assistance of third-party computer forensic specialists

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov