AccidentalHealthcareHealthcareMisconfigurationSupply Chain (3P Vendor)Customer Data InvolvedData ExfiltratedPHIHealth (basic)Identity (basic)LowContained

Cogent Healthcare, Inc.

bd_0df37bcbda25eaee · schema v1 · pii pii-v1

Severity

Low

Discovered

Jun 24, 2013

Filed

Aug 8, 2013

To disclose

6 weeks

Affected

Not disclosed

Confidence

65%

Full breach record for Cogent Healthcare, Inc. →3 incidents on file

Cogent Healthcare, Inc. disclosed a security lapse involving its third-party vendor, M2ComSys, a medical transcription company. Between May 5, 2013, and June 24, 2013, protected health information (PHI) including patient names, dates of birth, diagnoses, and treatment summaries was accessible via an insecure internet site. Cogent discovered the lapse on June 24, 2013, and immediately contained the access. The company ended its relationship with M2, secured the hardware, and confirmed removal of indexed data from Google. No Social Security numbers were involved.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 50 days

discovery → filing · 6 weeks / 45 days

May 5, 2013

Begins

Jun 24, 2013

Discovered

Aug 8, 2013

Filed

vs. sector median

6 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: Cogent Healthcare, Inc.
norm: cogent healthcare

Name: Cogent Healthcare, Inc.
norm: cogent healthcare
Industry: Healthcarellm

Discovered: Jun 24, 2013
Breach occurred: May 5, 2013 – Jun 24, 2013
Undetected for: 50 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: PHIHealth (basic)Identity (basic)
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain Compromise
Threat actor: External
Third party: via M2ComSys

During the incident: Took immediate steps to prevent further access of patient care notes
Began a full-scale investigation to determine how the incident occurred and to determine which data and individuals were involved
Ended our relationship with M2
Taken physical possession of the hardware held by M2 that stored our PHI
Confirmed with Google that it has removed all evidence of PHI from their files
Initiated a security review of other Cogent Healthcare, Inc. vendors who have access to PHI to confirm their security procedures
Changes made: Initiated a security review of other Cogent Healthcare, Inc. vendors who have access to PHI to confirm their security procedures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(45 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-42430
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 8, 2013
Raw hash: 73e325ed45b9ed2eb818fd95245d20c639b4a999f53d4c9f110ed9bb521b1f20

Reporting entityCogent Healthcare, Inc.

Victim entityCogent Healthcare, Inc.

Incidentdiscovered Jun 24, 2013

Stated responseTook immediate steps to prevent further access of patient care notes

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov