MalwareHealthcareTechnologyHealthcareRansomwareData EncryptedIdentity (basic)Health (basic)PHILowContained

Practice Resources, LLC

bd_11800686be0a841c · schema v1 · pii pii-v1

Severity

Low

Discovered

Jun 5, 2022

Filed

Aug 4, 2022

To disclose

9 weeks

Affected

20state residents only

Linked

4 filings

Confidence

66%

Full breach record for Practice Resources, LLC →

Practice Resources, LLC, a healthcare billing services provider, disclosed a ransomware attack on April 12, 2022. The incident potentially exposed PHI and PII, including names, addresses, treatment dates, health plan numbers, and medical record numbers. PRL determined on June 5, 2022, that the incident may have impacted affected individuals and offered 12-24 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 54 days

discovery → filing · 9 weeks / 60 days

Apr 12, 2022

Begins

Jun 5, 2022

Discovered

Aug 4, 2022

Filed

vs. sector median

4 wks faster

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

HHS OCRbd_7dc164d37315a5b82022-08-04Verified
California State AGbd_99e0914a03f54fb32022-08-04Verified
New Hampshire State AGbd_d1e9857a3de734942022-07-11 · +24dCandidate

Name: Practice Resources, LLC
norm: practice resources
Domain: prldocs.com
Industry: Healthcare Services

Name: Practice Resources, LLC
norm: practice resources
Domain: prldocs.com
Industry: Healthcare Services
Industry: HealthcarellmTechnologyllm

Discovered: Jun 5, 2022
Breach occurred: Apr 12, 2022
Undetected for: 54 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 20state-resident count only
Data types: Identity (basic)Health (basic)PHI
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for Impact
Threat actor: ExternalFinancial

During the incident: Took immediate steps to secure its systems
Investigated the nature and scope of the Incident
Arranged for IDX to provide free credit monitoring and related services
Changes made: Implemented a series of cybersecurity enhancements
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(60 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

New Hampshire State AGJul 11 · first

HHS OCR+24d

California State AG+24d

Montana State AG+24d · this page

Pattern: first filing Jul 11 (NH), last Aug 4 (MT) — a 24-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-Notification-Letter-473.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 4, 2022
Raw hash: d273444b81058158523de2612b059db04cd1956943a0314c523b0d94bfafd8ab

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityPractice Resources, LLC

Victim entityPractice Resources, LLC

Incidentdiscovered Jun 5, 2022

Stated responseTook immediate steps to secure its systems

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov