HackingHealthcareHealthcareStolen CredentialsCustomer Data InvolvedIdentity (basic)Government IDHealth (basic)Financial accountMediumContained

Fertility Centers of Illinois, PLLC

bd_1a6487cea814940c · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 1, 2021

Filed

Jan 4, 2022

To disclose

48 weeks

Affected

7state residents only

Linked

4 filings

Confidence

67%

Full breach record for Fertility Centers of Illinois, PLLC →

Fertility Centers of Illinois (FCI) notified Washington residents of a data breach discovered on February 1, 2021. An unauthorized third party accessed administrative files containing names, addresses, DOBs, SSNs, and medical/insurance info. Seven Washington residents were affected. FCI engaged forensic investigators, implemented enterprise identity verification software, provided enhanced employee training, and offered one year of Equifax credit monitoring.

J jump to incidentP pin to compareR raw source

Washington clock✗ WA AG >90d48 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

discovery → filing · 48 weeks / 337 days

Feb 1, 2021

Discovered

Jan 4, 2022

Filed

vs. sector median

+36 wks slower

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Massachusetts State AGbd_3e8dfe3174a5611f2022-01-04Verified
Illinois State AGbd_a654f5a2185de9612022-01-01 · +3dCandidate
HHS OCRbd_949b0931d0d42db52021-12-27 · +8dVerified

Name: Fertility Centers of Illinois, PLLC
norm: fertility centers of illinois

Name: Fertility Centers of Illinois, PLLC
norm: fertility centers of illinois
Industry: Healthcarellm

Discovered: Feb 1, 2021
Materiality determined: —
Notification sent: Jan 4, 2022
Affected individuals: 7state-resident count only
Data types: Identity (basic)Government IDHealth (basic)Financial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: External
Initial access: valid_credentials

During the incident: Engaged independent forensic investigators to conduct an investigation of the activity
Provided access to credit monitoring services for one (1) year, through Equifax, to individuals whose personal information was potentially affected by this incident, at no cost to these individuals
Provided impacted individuals with guidance on how to better protect against identity theft and fraud
Working to implement additional safeguards and training to its employees
Changes made: Implementation of enterprise identity verification software
All FCI employees have received enhanced training on security practices
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 48 weeks(337 days from discovery to filing)
Compliance flags: WA AG >90d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 3 states

View merged incident ↗

HHS OCRDec 27 · first

Illinois State AG+5d

Massachusetts State AG+8d

Washington State AG+8d · this page

Pattern: first filing Dec 27 (IL), last Jan 4 (WA) — a 8-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA5245.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 4, 2022
Raw hash: ded99a502a52cf9e38d7723c4ca7c142a46c443bcc1723401391c3ef5c9c79e0

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityFertility Centers of Illinois, PLLC

Victim entityFertility Centers of Illinois, PLLC

Incidentdiscovered Feb 1, 2021

Stated responseEngaged independent forensic investigators to conduct an investigation of the activity

ComplianceWA AG >90d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com