MalwareHealthcareTechnologyHealthcareRansomwareGandcrabData EncryptedDelayed DiscoveryIdentity (basic)Government IDPHIHealth (basic)MediumResolved

Doctors' Management Service, Inc

bd_1d84cc65754441c1 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Dec 24, 2018

Filed

Apr 22, 2019

To disclose

17 weeks

Affected

1state residents only

Linked

6 filings

Confidence

67%

Full breach record for Doctors' Management Service, Inc →2 incidents on file

Doctors’ Management Service, Inc. (DMS) disclosed a ransomware incident involving the GandCrab variant. Initial unauthorized access occurred on April 1, 2017 via RDP; technical issues were first noticed on December 24, 2018. The incident impacted personal health information (PHI) including names, SSNs, DOBs, driver's licenses, and medical data. No evidence of data exfiltration was found, but activity could not be ruled out. DMS restored data from backups, engaged forensic investigators, notified law enforcement and HHS, and offered credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 632 days

discovery → filing · 17 weeks / 119 days

Apr 1, 2017

Begins

Dec 24, 2018

Discovered

Apr 22, 2019

Filed

vs. sector median

+4 wks slower

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

HHS OCRbd_93af1e4de88761ea2019-04-22Verified
Massachusetts State AGbd_31de1d03468648ee2019-04-23 · +1dVerified
Oregon State AGbd_525d9e853fad41d72019-04-24 · +2dVerified
New Hampshire State AGbd_2817736d1e5cea712019-05-28 · +36dVerified

Show 1 more filing ↓up to 1653d gap

HHS OCR enforcementbd_928833438d5c3c322023-10-31 · +1653dVerified by operator

Name: Doctors' Management Service, Inc
norm: doctors management service
Domain: doctorsmanagementservice.org

Name: Doctors' Management Service, Inc
norm: doctors management service
Domain: doctorsmanagementservice.org
Industry: HealthcarellmTechnologyllm

Discovered: Dec 24, 2018
Breach occurred: Apr 1, 2017
Undetected for: 632 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government IDPHIHealth (basic)
Data elements: Social Security numberDate of birthMedical information
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Provided notice to the U.S. Department of Health and Human Services
Initial access: external_remote_services

During the incident: Engaged leading forensic investigators
Contacted law enforcement
Changed network security system to limit access from outside the network
Provided notice to the U.S. Department of Health and Human Services
Offered complimentary one-year membership to Experian IdentityWorks Credit 3B
Offered identity restoration services
Changes made: Changed network security system to limit access to systems from outside of the network
Improved network security
Working with outside information security experts to prevent similar occurrences
Educating staff on cyber best practices
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 17 weeks(119 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 4 states

View merged incident ↗

HHS OCRApr 22 · first

Montana State AGApr 22 · first · this page

Massachusetts State AG+1d

Oregon State AG+2d

New Hampshire State AG+36d

HHS OCR enforcement+1653d

Pattern: first filing Apr 22 (MA), last Oct 31 — a 1653-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/CON-MT-Notice-of-Data-Security-Incident-for-DMS.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 22, 2019
Raw hash: 35a7ace916bb24b30111d90a1ecc1e9ef183178e6b14511453830716317738d4

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityDoctors' Management Service, Inc

Victim entityDoctors' Management Service, Inc

Incidentdiscovered Dec 24, 2018

Stated responseEngaged leading forensic investigators

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov