HackingHealthcareHealthcareStolen CredentialsTargetedIdentity (basic)Government IDMediumContained

Coastal Orthopedics

bd_0dc2763c9113543d · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 11, 2023

Filed

Jun 26, 2024

To disclose

13 months

Affected

Not disclosed

Linked

5 filings

Confidence

68%

Full breach record for Coastal Orthopedics →

Coastal Orthopedics notified consumers of unauthorized network access between June 6-11, 2023. The breach affected patient names and government IDs. The company engaged third-party specialists, reviewed affected files, and offered credit monitoring. 86 Rhode Island residents were explicitly identified as impacted.

J jump to incidentP pin to compareR raw source

Vermont clock✗ VT AG >45 bday13 months discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 5 days

discovery → filing · 13 months / 381 days

Jun 6, 2023

Begins

Jun 11, 2023

Discovered

Jun 26, 2024

Filed

vs. sector median

+45 wks slower

This filing is one of 5 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

New Hampshire State AGbd_32ea7db31644fdf62024-06-26Verified
Massachusetts State AGbd_4981b9aff672a2782024-06-26Verified
Montana State AGbd_977e96cb8d0c1fd12024-06-26Candidate
Illinois State AGbd_ece61e2be09698d72024-06-01 · +25dVerified

Name: Coastal Orthopedics
norm: coastal orthopedics
Domain: coastalorthopedics.com

Name: Coastal Orthopedics
norm: coastal orthopedics
Domain: coastalorthopedics.com
Industry: Healthcarellm

Discovered: Jun 11, 2023
Breach occurred: Jun 6, 2023 – Jun 11, 2023
Undetected for: 5 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 26, 2024
Affected individuals: Not disclosed
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: notify, or have notified, applicable regulatory authorities where necessary
Initial access: valid_credentials

During the incident: Launched an investigation to determine the nature and scope of the activity
Engaged third-party specialists
Conducted a comprehensive and time-intensive review of the contents of the files
Reviewing our policies, procedures and processes
Offering complimentary access to credit monitoring services through CyEx
Changes made: Re-reviewing our policies, procedures and processes to see if we can further reduce the likelihood of a similar future event
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 13 months(381 days from discovery to filing)
Compliance flags: VT AG >45 bday
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Illinois State AGJun 1 · first

New Hampshire State AG+25d

Massachusetts State AG+25d

Montana State AG+25d

Vermont State AG+25d · this page

Pattern: first filing Jun 1 (IL), last Jun 26 (VT) — a 25-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ago.vermont.gov/document/2024-06-26-coastal-orthopedics-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 26, 2024
Raw hash: dcba677199cf1ad982c77b894db39c5833b8c783d76c22cf8aecffb71fe52d6b

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityCoastal Orthopedics

Victim entityCoastal Orthopedics

Incidentdiscovered Jun 11, 2023

Stated responseLaunched an investigation to determine the nature and scope of the activity

ComplianceVT AG >45 bday

Extraction provenanceno artifact recorded

Source provenanceago.vermont.gov