PhysicalHealthcareHealthcareTheftCustomer Data InvolvedPHIGovernment IDIdentity (basic)Health (basic)MediumContained

Max M Bayard MD, PC

bd_0f6044cd6b1c8c41 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 5, 2015

Filed

Sep 11, 2015

To disclose

5 weeks

Affected

2state residents only

Linked

2 filings

Confidence

64%

Full breach record for Max M Bayard MD, PC →

Max M. Bayard, MD PC, a private medical practice in St. Albans, VT, reported the theft of computer devices from its offices on August 5, 2015. The incident potentially exposed protected health information, including names, Social Security numbers, and treatment-related data, for two New Hampshire residents. The practice notified law enforcement, changed passwords, and offered credit monitoring services.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 5 weeks / 37 days

Aug 5, 2015

Begins

Aug 5, 2015

Discovered

Sep 11, 2015

Filed

vs. sector median

7 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

HHS OCRbd_fc07d0141c3797112015-08-07 · +35dCandidate

Name: Max M. Bayard, MD PC
norm: max m bayard md pc
Domain: wilsonelser.com

Name: Max M Bayard MD, PC
norm: max m bayard md
Industry: Healthcarellm

Discovered: Aug 5, 2015
Breach occurred: Aug 5, 2015
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 11, 2015
Affected individuals: 2state-resident count only
Data types: PHIGovernment IDIdentity (basic)Health (basic)
Data elements: Date of birthMedical information
Attack vector: Unknown
MITRE ATT&CK: T1052 Exfiltration Over Physical Medium
Threat actor: External
Regulator citations: Notified Attorney General Joseph Foster, Office of the Attorney General

During the incident: Notified law enforcement and is cooperating with their investigation
Changed his firewall password
Changed all software-related, login, and email account passwords
Offering potentially impacted individuals credit monitoring and identity protection services at no cost to the individual through AllClear ID
Changes made: Installing security cameras
Securing the computers in a safe when not in use
Encrypting all computers
Reviewing policies and procedures for the secure storage of personal information
Staff is being trained on these additional safeguards
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(37 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

HHS OCRAug 7 · first

New Hampshire State AG+35d · this page

Pattern: first filing Aug 7 (VT), last Sep 11 (NH) — a 35-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/bayard-max-20150911.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 11, 2015
Raw hash: ffcce238dc902f5726b38b06adae6b4c29b08135d966cbab71142df8837053fc

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityMax M. Bayard, MD PC

Victim entityMax M Bayard MD, PC

Incidentdiscovered Aug 5, 2015

Stated responseNotified law enforcement and is cooperating with their investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov