AccidentalHealthcareTechnologyHealthcareMisconfigurationData ExfiltratedCustomer Data InvolvedSupply Chain (3P Vendor)Identity (basic)Government IDHealth (basic)MediumContained

BioTel Heart

bd_1569237f042443e9 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 28, 2021

Filed

Mar 26, 2021

To disclose

8 weeks

Affected

68state residents only

Linked

2 filings

Confidence

67%

Full breach record for BioTel Heart →

BioTel Heart notified the New Hampshire Attorney General of a data security incident involving 68 NH residents. On January 28, 2021, the company learned that a vendor's subcontractor misconfigured an AWS server, exposing patient medical records, SSNs, and contact info. BioTel Heart secured the data, terminated the vendor relationship, and provided 24 months of credit monitoring to affected individuals. Notifications were sent on March 26, 2021.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 8 weeks / 57 days

Jan 28, 2021

Discovered

Mar 26, 2021

Filed

vs. sector median

4 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

South Carolina State AGbd_4092603151ff56332021-03-26Candidate

Name: BioTel Heart
norm: biotel heart

Name: BioTel Heart
norm: biotel heart
Industry: HealthcarellmTechnologyllm

Discovered: Jan 28, 2021
Materiality determined: —
Notification sent: Mar 26, 2021
Affected individuals: 68state-resident count only
Data types: Identity (basic)Government IDHealth (basic)
Data elements: Social Security numberDate of birthMedical information
Attack vector: Misconfiguration
MITRE ATT&CK: T1078 Valid AccountsT1190 Exploit Public-Facing Application
Threat actor: External
Regulator citations: Notified Office of the Attorney General, State of New Hampshire

During the incident: Took steps to investigate and respond to this incident
Confirmed that the vendor’s subcontractor has secured the information stored on the server
Arranged for Equifax to provide credit monitoring and identity restoration services at no charge to all affected individuals for twenty‐four (24) months
Terminated its business relationship with the vendor pending its investigation of the incident
Sending letters by U.S. mail to all affected individuals
Changes made: Terminated the business arrangement with the subcontractor responsible for this incident
Will require the subcontractor to securely delete all copies of the records
Evaluating whether to re‐engage the vendor, provided that certain parameters are met, including a renegotiated agreement between the Company and the vendor that would provide the Company the right to receive notice of and consent to the Company’s subcontractors that will have access to the personal information
Conduct additional data security diligence of the vendor
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(57 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

South Carolina State AGMar 26 · first

New Hampshire State AGMar 26 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/biotel-heart-20210326.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 26, 2021
Raw hash: de4fdd73efeba140f2f59ce955dee5a5d0a9d8e5e8e6f2588d308858503f5b4e

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityBioTel Heart

Victim entityBioTel Heart

Incidentdiscovered Jan 28, 2021

Stated responseTook steps to investigate and respond to this incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov