MalwareHealthcareHealthcareRansomwareData EncryptedSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)Government IDHealth (basic)Financial accountMediumActive

Summit Eye Associates

bd_1658afa246fd6865 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 1, 2022

Filed

Apr 27, 2022

To disclose

8 weeks

Affected

5state residents only

Linked

4 filings

Confidence

66%

Full breach record for Summit Eye Associates →

Summit Eye Associates notified patients of a data security incident involving third-party vendor Eye Care Leaders. Unauthorized access occurred around Dec 4, 2021, resulting in database deletion. Patient data potentially exposed includes names, DOB, SSN, and medical info. Summit offers one year of IDX identity protection.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 87 days

discovery → filing · 8 weeks / 57 days

Dec 4, 2021

Begins

Mar 1, 2022

Discovered

Apr 27, 2022

Filed

vs. sector median

3 wks faster

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Massachusetts State AGbd_03ffc11fa5efa9ea2022-04-27Verified
HHS OCRbd_22fafde50db6ff322022-04-27Verified
Maine State AGbd_7258ba2fe96707822022-04-27Verified

Name: Summit Eye Associates
norm: summit eye associates

Name: Summit Eye Associates
norm: summit eye associates
Industry: Healthcarellm

Discovered: Mar 1, 2022
Breach occurred: Dec 4, 2021
Undetected for: 87 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 27, 2022
Affected individuals: 5state-resident count only
Data types: Identity (basic)Government IDHealth (basic)Financial account
Data elements: Social Security numberDate of birthMedical information
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1078 Valid Accounts
Threat actor: External
Third party: via Eye Care Leaders

During the incident: Offering complimentary one-year membership to IDX identity protection services
In process of terminating its vendor relationship with Eye Care Leaders
Changes made: Terminating vendor relationship with Eye Care Leaders
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(57 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Massachusetts State AGApr 27 · first

HHS OCRApr 27 · first

Maine State AGApr 27 · first

Montana State AGApr 27 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-Notification-Letter-325.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 27, 2022
Raw hash: da945db797c32d8bdcbd0d1adc3653f0297fa2a70de774deee37351a261c9af5

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entitySummit Eye Associates

Victim entitySummit Eye Associates

Incidentdiscovered Mar 1, 2022

Stated responseOffering complimentary one-year membership to IDX identity protection services

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov