Social EngineeringHealthcareHealthcarePhishingStolen CredentialsCustomer Data InvolvedEmployee Data InvolvedPHIIdentity (basic)Government IDFinancial accountHealth (basic)MinorMediumContained

MEDNAX Services, Inc.

bd_1253ca6eeacfa879 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 19, 2020

Filed

Dec 16, 2020

To disclose

26 weeks

Affected

45state residents only

Linked

8 filings

Confidence

66%

Full breach record for MEDNAX Services, Inc. →2 incidents on file

MEDNAX Services, Inc. disclosed that an unauthorized third party gained access to certain Microsoft Office 365-hosted business email accounts via phishing between June 17 and June 22, 2020. The incident was discovered on June 19, 2020. Personal information of 45 Rhode Island residents, including PHI, SSNs, and financial data, may have been accessed. MEDNAX engaged forensic investigators, reset passwords, and offered one year of identity monitoring.

J jump to incidentP pin to compareR raw source

California clockDiscovered Jun 19, 2020 → Notified Dec 16, 2020180d ✗ CA 60-day late26 weeks discovery → filing

Incident timeline

undetected · 2 days

discovery → filing · 26 weeks / 180 days

Jun 17, 2020

Begins

Jun 19, 2020

Discovered

Dec 16, 2020

Filed

vs. sector median

+13 wks slower

This filing is one of 8 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (7) · sorted by filing gap

HHS OCRbd_2317d15fb2fdc5372020-12-16Candidate
Montana State AGbd_3c1d1683a865d9562020-12-16Verified
Oregon State AGbd_cc27b0970ea647262020-12-16Verified
Washington State AGbd_ef1f98abb4d60c8e2020-12-16Verified

Show 3 more filings ↓up to 27d gap

Massachusetts State AGbd_0556c2fd8b6abc362020-12-23 · +7dVerified
California State AGbd_11476f6352fa26262020-12-23 · +7dCandidate
New Hampshire State AGbd_c82e812b30165e942021-01-12 · +27dVerified

Name: MEDNAX Services, Inc.
norm: mednax services

Name: MEDNAX Services, Inc.
norm: mednax services
Industry: Healthcarellm

Discovered: Jun 19, 2020
Breach occurred: Jun 17, 2020 – Jun 22, 2020
Undetected for: 2 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 16, 2020
Affected individuals: 45state-resident count only
Data types: PHIIdentity (basic)Government IDFinancial accountHealth (basic)Minor
Data elements: Social Security numberDate of birthMedical information
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: External
Initial access: phishing_link

During the incident: Immediately took action to prevent any further unauthorized activity
Began an investigation
Engaged a national forensic firm
Resetting user passwords for business email accounts where unauthorized activity was detected
Changes made: Enhance our security controls as appropriate to minimize the risk of any similar event in the future
Offered identity monitoring services for a period of one year, at no cost
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 26 weeks(180 days from discovery to filing)
Compliance flags: CA 60-day late · 180d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Jun 19, 2020
→ Notified: Dec 16, 2020
180d 60 days (analyst band, pre-2026 discoveries) CA 60-day late

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Jun 19, 2020 → Notified: Dec 16, 2020	180d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 7 states

View merged incident ↗

HHS OCRDec 16 · first

Montana State AGDec 16 · first

Oregon State AGDec 16 · first

Washington State AGDec 16 · first

California State AGDec 16 · first · this page

Massachusetts State AG+7d

California State AG+7d

New Hampshire State AG+27d

Pattern: first filing Dec 16 (FL), last Jan 12 (NH) — a 27-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-197246
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 16, 2020
Raw hash: 793d84008ff18d32ed08762cfab3a94831d5b584aadf410587826a25599e5b40

Linked disclosures

Regulatory filings (7) · sorted by filing gap

Reporting entityMEDNAX Services, Inc.

Victim entityMEDNAX Services, Inc.

Incidentdiscovered Jun 19, 2020

Stated responseImmediately took action to prevent any further unauthorized activity

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov