Social EngineeringHealthcareHealthcarePhishingStolen CredentialsSupply Chain (3P Vendor)Customer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDPHIHealth (basic)Financial accountHighContained

American Anesthesiology, Inc.

bd_19020fa39edc65a5 · schema v1 · pii pii-v1

Severity

High

Discovered

Jul 16, 2020

Filed

Apr 12, 2021

To disclose

39 weeks

Affected

14,138state residents only

Linked

7 filings

Confidence

64%

Full breach record for American Anesthesiology, Inc. →2 incidents on file

American Anesthesiology, Inc. notified patients of a security event involving its business associate, MEDNAX Services, Inc. Unauthorized access to email accounts occurred via phishing between June 17-22, 2020. American Anesthesiology was notified on July 16, 2020. Affected data included patient PII, SSNs, PHI, and financial info. No actual misuse was detected. Remediation included password resets, access restrictions, and employee training.

J jump to incidentP pin to compareR raw source

South Carolina clock✓ SC CRA notice due39 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 29 days

discovery → filing · 39 weeks / 270 days

Jun 17, 2020

Begins

Jul 16, 2020

Discovered

Apr 12, 2021

Filed

vs. sector median

+28 wks slower

This filing is one of 7 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

Massachusetts State AGbd_c19297281c202d402021-01-09 · +93dVerified
HHS OCRbd_1c89d410047f27b12021-01-08 · +94dVerified
Oregon State AGbd_3f02b387fd1197ea2021-01-08 · +94dVerified
Maine State AGbd_6905374190db86e62021-01-08 · +94dVerified

Show 2 more filings ↓up to 94d gap

Indiana State AGbd_9412215949323f172021-01-08 · +94dVerified
California State AGbd_c1cbfd29ce17dc042021-01-08 · +94dVerified

Name: American Anesthesiology, Inc.
norm: american anesthesiology

Name: American Anesthesiology, Inc.
norm: american anesthesiology
Industry: Healthcarellm

Discovered: Jul 16, 2020
Breach occurred: Jun 17, 2020 – Jun 22, 2020
Undetected for: 29 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 14,138state-resident count only
Data types: Identity (basic)Government IDPHIHealth (basic)Financial account
Data elements: Social Security numberDate of birthMedical information
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Third party: via MEDNAX Services, Inc.
Initial access: phishing_link

During the incident: Terminated the unauthorized party’s access to the O365 System
Reset each user’s password for the email accounts where unauthorized activity was detected
Moved email accounts used by American Anesthesiology employees to our email system
Added authentication requirements to restrict access to the email accounts
Offering complimentary subscription to credit monitoring
Changes made: Introducing additional authentication and security training requirements for all employees in 2021 to counteract phishing and other social engineering techniques
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 39 weeks(270 days from discovery to filing)
Compliance flags: SC CRA notice due
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 7 states

View merged incident ↗

HHS OCRJan 8 · first

Oregon State AGJan 8 · first

Maine State AGJan 8 · first

Indiana State AGJan 8 · first

California State AGJan 8 · first

Massachusetts State AG+1d

South Carolina State AG+94d · this page

Pattern: first filing Jan 8 (NY), last Apr 12 (SC) — a 94-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/AmericanAnesthesiology.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 12, 2021
Raw hash: 0d03dad1139e82c5e458c49df69d83e464557f422207708abaa891cf566cbe45

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityAmerican Anesthesiology, Inc.

Victim entityAmerican Anesthesiology, Inc.

Incidentdiscovered Jul 16, 2020

Stated responseTerminated the unauthorized party’s access to the O365 System

ComplianceSC CRA notice due

Extraction provenanceno artifact recorded

Source provenanceconsumer.sc.gov