AccidentalHealthcareProfessional ServicesHealthcareMisconfigurationCustomer Data InvolvedData ExfiltratedIdentity (basic)Government IDHealth (basic)MediumContained

MedEvolve

bd_0bd4122eff0cddb4 · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 11, 2018

Filed

Jul 10, 2018

To disclose

9 weeks

Affected

Not disclosed

Linked

8 filings

Confidence

64%

Full breach record for MedEvolve →

MedEvolve, a provider of electronic billing and record services to physicians and medical facilities, discovered on May 11, 2018, that an FTP file containing patient information was inadvertently accessible to the internet from March 29, 2018, to May 4, 2018. The file was subject to unauthorized access on March 29, 2018. Affected data included names, billing addresses, telephone numbers, primary health insurer account numbers, and Social Security numbers. MedEvolve secured the portal, engaged forensic investigators, and offered two years of complimentary credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 43 days

discovery → filing · 9 weeks / 60 days

Mar 29, 2018

Begins

May 11, 2018

Discovered

Jul 10, 2018

Filed

vs. sector median

4 wks faster

This filing is one of 8 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (7) · sorted by filing gap

Massachusetts State AGbd_2cc6cf8c3756184a2018-07-10Verified
HHS OCRbd_6ac38550f52fc8d32018-07-10Verified
New Hampshire State AGbd_a0496aa58a430ab52018-07-10Verified
Montana State AGbd_a2d9849fbe9658052018-07-10Verified

Show 3 more filings ↓up to 1771d gap

New Hampshire State AGbd_0f2d25b2273b13f32018-07-27 · +17dVerified by operator
Massachusetts State AGbd_9f8a44684fb3d8bb2018-07-30 · +20dVerified by operator
HHS OCR enforcementbd_43a0abb3eba49ad42023-05-16 · +1771dVerified by operator

Name: MedEvolve
norm: medevolve

Name: MedEvolve
norm: medevolve
Industry: HealthcarellmProfessional Servicesllm

Discovered: May 11, 2018
Breach occurred: Mar 29, 2018
Undetected for: 43 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDHealth (basic)
Attack vector: Misconfiguration
Threat actor: External
Regulator citations: Providing notice to the U.S. Department of Health and Human ServicesProviding notice to state regulators as required
Initial access: exploit_public_facing

During the incident: Immediately secured the portal in question and took steps to prevent further access
Hired a third-party forensic investigator to conduct an exhaustive investigation of this matter
Providing notice to the U.S. Department of Health and Human Services, relevant media outlets, and state regulators as required
Arranged for complimentary credit monitoring service (myTrueIdentity) for two years provided by TransUnion Interactive
Changes made: Working to implement additional safeguards and security measures to enhance the privacy and security of information in our systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(60 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 5 states

View merged incident ↗

Massachusetts State AGJul 10 · first

HHS OCRJul 10 · first

New Hampshire State AGJul 10 · first

Montana State AGJul 10 · first

California State AGJul 10 · first · this page

New Hampshire State AG+17d

Massachusetts State AG+20d

HHS OCR enforcement+1771d

Pattern: first filing Jul 10 (MA), last May 16 — a 1771-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-137784
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 10, 2018
Raw hash: e7b6de3316cbaa3e249629e189c272e5923101e73d78f1f1c8b77623f70376ac

Linked disclosures

Regulatory filings (7) · sorted by filing gap

Reporting entityMedEvolve

Victim entityMedEvolve

Incidentdiscovered May 11, 2018

Stated responseImmediately secured the portal in question and took steps to prevent further access

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov