HackingProfessional ServicesProfessional ServicesVulnerability ExploitTargetedData ExfiltratedFinancial accountIdentity (basic)LowContained

American Society for Clinical Pathology

bd_1c56d6fdb347f291 · schema v1 · pii pii-v1

Severity

Low

Discovered

Mar 11, 2021

Filed

Apr 12, 2021

To disclose

5 weeks

Affected

138state residents only

Linked

8 filings

Confidence

66%

Full breach record for American Society for Clinical Pathology →

ASCP notified NH AG of a cybersecurity attack on its e-commerce website exposing payment card data (names, card numbers, CVVs) for ~138 NH residents. Attack occurred between March 30 and Nov 6, 2020. ASCP engaged forensic investigators, resolved the issue, and implemented additional security safeguards. No evidence of misuse found.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 346 days

discovery → filing · 5 weeks / 32 days

Mar 30, 2020

Begins

Mar 11, 2021

Discovered

Apr 12, 2021

Filed

vs. sector median

13 wks faster

This filing is one of 8 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (7) · sorted by filing gap

Washington State AGbd_0068d4a7a36ff7b72021-04-07 · +5dVerified by operator
California State AGbd_50dbb9c8e5101fcf2021-04-07 · +5dVerified
Massachusetts State AGbd_ae4d677d9170ca6d2021-04-07 · +5dVerified
Maine State AGbd_cb2b3e87c8a69a2e2021-04-07 · +5dVerified by operator

Show 3 more filings ↓up to 29d gap

Montana State AGbd_2e4a4fe0820ab0af2021-04-01 · +11dCandidate
Indiana State AGbd_8246d19f98183f762021-04-01 · +11dVerified
Oregon State AGbd_1a1b74d201b159d82021-05-11 · +29dVerified by operator

Name: MCDONALD HOPKINS LLC
norm: mcdonald hopkins

Name: American Society for Clinical Pathology
norm: american society for clinical pathology
Domain: ascp.org
Industry: Professional Servicesllm

Discovered: Mar 11, 2021
Breach occurred: Mar 30, 2020 – Nov 6, 2020
Undetected for: 346 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 1, 2021
Affected individuals: 138state-resident count only
Data types: Financial accountIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney General
Initial access: exploit_public_facing

During the incident: Engaged external forensic investigators and data privacy professionals
Conducted a thorough investigation into the incident
Provided the affected residents with written notification
Advised affected residents about the process for placing fraud alerts and/or security freezes
Advised affected residents to review their financial account statements for fraudulent or irregular activity
Changes made: Resolved the issue that led to the potential exposure on the website
Implemented additional security safeguards to protect against future intrusions
Continues ongoing intensive monitoring of its website
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(32 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 8 states

View merged incident ↗

Montana State AGApr 1 · first

Indiana State AGApr 1 · first

Washington State AG+6d

California State AG+6d

Massachusetts State AG+6d

Maine State AG+6d

New Hampshire State AG+11d · this page

Oregon State AG+40d

Pattern: first filing Apr 1 (MT), last May 11 (OR) — a 40-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/american-society-clinical-pathology-20210412.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 12, 2021
Raw hash: 0bd5553e3c4622ad8c76acf1823385a03f0329109ece77685cbede67a6e8019f

Linked disclosures

Regulatory filings (7) · sorted by filing gap

Reporting entityMCDONALD HOPKINS LLC

Victim entityAmerican Society for Clinical Pathology

Incidentdiscovered Mar 11, 2021

Stated responseEngaged external forensic investigators and data privacy professionals

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov