MalwareHealthcareHealthcareRansomwareStolen CredentialsData ExfiltratedData EncryptedCustomer Data InvolvedIdentity (basic)Government IDFinancial accountMediumContained

Allergy Partners, PLLC

bd_205799997e0cd527 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 23, 2021

Filed

Apr 23, 2021

To disclose

8 weeks

Affected

2state residents only

Linked

5 filings

Confidence

66%

Full breach record for Allergy Partners, PLLC →3 incidents on file

Allergy Partners, PLLC notified Montana residents of a cybersecurity incident where unauthorized access occurred between Jan 12 and Feb 23, 2021. The attacker deployed malware and exfiltrated documents containing names, DOBs, SSNs, driver's licenses, and financial account info. The company engaged forensic investigators and is offering one year of Experian IdentityWorks.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 42 days

discovery → filing · 8 weeks / 59 days

Jan 12, 2021

Begins

Feb 23, 2021

Discovered

Apr 23, 2021

Filed

vs. sector median

1 wks faster

This filing is one of 5 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Indiana State AGbd_057ae5e8dec726fb2021-04-23Verified
Massachusetts State AGbd_642eaacc9981a6692021-04-23Verified
HHS OCRbd_a9b66103b06d3f472021-04-23Verified
New Hampshire State AGbd_29a25e665b4cb65d2021-04-26 · +3dVerified

Name: Allergy Partners, PLLC
norm: allergy partners

Name: Allergy Partners, PLLC
norm: allergy partners
Industry: Healthcarellm

Discovered: Feb 23, 2021
Breach occurred: Jan 12, 2021 – Feb 23, 2021
Undetected for: 42 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 2state-resident count only
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security numberDate of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1078 Valid Accounts
Threat actor: ExternalFinancial
Initial access: valid_credentials

During the incident: Took steps to secure the network
Began an investigation with the assistance of a computer forensic firm
Changes made: Continuing to regularly audit our system for potential unauthorized activity
Implementing enhanced network monitoring tools
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(59 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Indiana State AGApr 23 · first

Massachusetts State AGApr 23 · first

HHS OCRApr 23 · first

Montana State AGApr 23 · first · this page

New Hampshire State AG+3d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/Allergy-Partners-Notif.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 23, 2021
Raw hash: 66b8fbab4aa114d022b6e1bf6e18f3ea1c514fc3cad21eb47b246672208ae314

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityAllergy Partners, PLLC

Victim entityAllergy Partners, PLLC

Incidentdiscovered Feb 23, 2021

Stated responseTook steps to secure the network

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov