HackingHealthcareHealthcareStolen CredentialsCustomer Data InvolvedPHIIdentity (basic)LowContained

Summit Eye & Optical

bd_1960b5eba3f955ff · schema v1 · pii pii-v1

Severity

Low

Discovered

Mar 4, 2023

Filed

May 30, 2023

To disclose

12 weeks

Affected

3state residents only

Linked

5 filings

Confidence

68%

Full breach record for Summit Eye & Optical →

Summit Eye & Optical notified the NH Attorney General on May 22, 2023, of a data incident discovered on March 4, 2023. An unknown person gained unauthorized access to computer systems, potentially viewing PHI and personal info of 3 NH residents. Summit conducted an internal investigation, enhanced security measures, and provided 12 months of identity monitoring services to affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 12 weeks / 87 days

Mar 4, 2023

Discovered

May 30, 2023

Filed

vs. sector median

+1 wks slower

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Maine State AGbd_3bf07cd3d59051b82023-06-07 · +8dVerified
Massachusetts State AGbd_1ac7ac272ef034cb2023-05-19 · +11dCandidate
Indiana State AGbd_6c9c8587121fd9d62023-05-18 · +12dVerified
HHS OCRbd_ba328409c4045e322023-05-01 · +29dCandidate

Name: Summit Eye & Optical
norm: summit eye optical

Name: Summit Eye & Optical
norm: summit eye optical
Industry: Healthcarellm

Discovered: Mar 4, 2023
Materiality determined: —
Notification sent: —
Affected individuals: 3state-resident count only
Data types: PHIIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified NH Department of Justice
Initial access: valid_credentials

During the incident: Conducted an internal investigation to understand what had taken place and how
Reviewed the internal data management and protocols
Implemented enhanced security measures to help prevent this type of incident from recurring
Arranged to protect the individuals affected by this incident by providing identity monitoring services for 12 months at no cost to the individuals
Forwarded letters notifying them of this incident
Changes made: Reviewed internal data management and protocols
Implemented enhanced security measures to help prevent this type of incident from recurring
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 12 weeks(87 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

HHS OCRMay 1 · first

Indiana State AG+17d

Massachusetts State AG+18d

New Hampshire State AG+29d · this page

Maine State AG+37d

Pattern: first filing May 1 (NJ), last Jun 7 (ME) — a 37-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/summit-eye-optical-20230530.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 30, 2023
Raw hash: 5880e95939824403db0a7959b166f2de2cfb362601cfe4efbaf4713a8f6186d0

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entitySummit Eye & Optical

Victim entitySummit Eye & Optical

Incidentdiscovered Mar 4, 2023

Stated responseConducted an internal investigation to understand what had taken place and how

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov