HackingHealthcareHealthcareStolen CredentialsTargetedPHIHealth (basic)Identity (basic)Government IDFinancial accountCredentialsMediumContained

New Jersey Brain and Spine

bd_144958525a52f7ca · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 16, 2021

Filed

Apr 8, 2022

To disclose

20 weeks

Affected

1state residents only

Linked

6 filings

Confidence

63%

Full breach record for New Jersey Brain and Spine →2 incidents on file

New Jersey Brain & Spine notified patients of a cybersecurity incident discovered on November 16, 2021, involving unauthorized access to protected health information. Data exposed included names, SSNs, financial account info, and medical records. The company engaged forensic investigators, migrated to a cloud platform, implemented MFA, and offered 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 20 weeks / 143 days

Nov 16, 2021

Discovered

Apr 8, 2022

Filed

vs. sector median

+8 wks slower

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Indiana State AGbd_50450d6389e21dbb2022-04-08Verified
Massachusetts State AGbd_aae3f3f7b0f7ad992022-04-08Verified
Maine State AGbd_c6eb25ae4babc5552022-04-08Verified
New Hampshire State AGbd_9cb0bf55c2fff68a2022-04-14 · +6dVerified

Show 1 more filing ↓up to 97d gap

Illinois State AGbd_5160ed01171992722022-01-01 · +97dCandidate

Name: New Jersey Brain and Spine
norm: new jersey brain and spine
Domain: njbrainspine.com

Name: New Jersey Brain and Spine
norm: new jersey brain and spine
Domain: njbrainspine.com
Industry: Healthcarellm

Discovered: Nov 16, 2021
Materiality determined: —
Notification sent: Apr 7, 2022
Affected individuals: 1state-resident count only
Data types: PHIHealth (basic)Identity (basic)Government IDFinancial accountCredentials
Data elements: Social Security numberDate of birthMedical information
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Initial access: valid_credentials

During the incident: Engaged a third party cybersecurity firm to conduct a forensics investigation
Migrated to a third-party hosted cloud-based platform to securely store patient data
Implemented two-factor authentication
Installed a new server
Implemented ongoing monitoring response which tracks user activity, services and ports and coordinates logging
Arranged for IDX to provide complimentary credit monitoring services and identity theft protection services
Changes made: Migrated to a third-party hosted cloud-based platform to securely store patient data
Implemented two-factor authentication
Installed a new server
Implemented ongoing monitoring response which tracks user activity, services and ports and coordinates logging
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 20 weeks(143 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Illinois State AGJan 1 · first

Indiana State AG+97d

Massachusetts State AG+97d

Maine State AG+97d

Montana State AG+97d · this page

New Hampshire State AG+103d

Pattern: first filing Jan 1 (IL), last Apr 14 (NH) — a 103-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-Notification-Letter-300.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 8, 2022
Raw hash: 0255a817d04125071142c4f7a8e1cb07c832eb299e397fc2be65963ac3ad64e9

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityNew Jersey Brain and Spine

Victim entityNew Jersey Brain and Spine

Incidentdiscovered Nov 16, 2021

Stated responseEngaged a third party cybersecurity firm to conduct a forensics investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov