HackingHealthcarePIIIdentity (basic)Government IDMediumContained

OrthoAlaska, LLC

bd_2243577418f9038a · schema v1 · pii pii-v1

Severity

Medium

Discovered

Oct 12, 2022

Filed

Oct 12, 2023

To disclose

12 months

Affected

40state residents only

Linked

7 filings

Confidence

67%

Full breach record for OrthoAlaska, LLC →2 incidents on file

OrthoAlaska, LLC notified the New Hampshire Attorney General of a data security incident discovered on October 12, 2022. Unauthorized access to patient files containing personal information occurred. Forty New Hampshire residents were notified. Response actions included engaging forensic experts, notifying the FBI, and offering credit monitoring services.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 12 months / 365 days

Oct 12, 2022

Discovered

Oct 12, 2023

Filed

This filing is one of 7 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

Washington State AGbd_630a6272366a9e322023-10-13 · +1dVerified
Maine State AGbd_7b82937d6cbd83072023-10-13 · +1dVerified
California State AGbd_8fae6c27242b6c072023-10-13 · +1dVerified
Oregon State AGbd_c52da3c2c9a6fa5a2023-10-13 · +1dVerified

Show 2 more filings ↓up to 192d gap

Massachusetts State AGbd_f0e02ecdc89f35232023-10-13 · +1dVerified
Montana State AGbd_5184f8b3b12232a92023-04-03 · +192dCandidate

Name: OrthoAlaska, LLC
norm: orthoalaska

Name: OrthoAlaska, LLC
norm: orthoalaska

Discovered: Oct 12, 2022
Materiality determined: —
Notification sent: Sep 13, 2023
Affected individuals: 40state-resident count only
Data types: PIIIdentity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Reported the incident to the Federal Bureau of Investigation
Initial access: valid_credentials

During the incident: Retained independent cybersecurity experts to conduct a forensic investigation
Reported the incident to the Federal Bureau of Investigation
Provided individuals whose SSN was potentially affected with access to Single Bureau Credit Monitoring/Single Bureau Credit Report/Single Bureau Credit Score services at no charge
Provided individuals with proactive fraud assistance through IDX through CyberScan
Changes made: Implemented additional security measures to protect their digital environment and minimize the likelihood of future incidents
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 12 months(365 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 7 states

View merged incident ↗

Montana State AGApr 3 · first

New Hampshire State AG+192d · this page

Washington State AG+193d

Maine State AG+193d

California State AG+193d

Oregon State AG+193d

Massachusetts State AG+193d

Pattern: first filing Apr 3 (MT), last Oct 13 (MA) — a 193-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/orthoalaska-20231012.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 12, 2023
Raw hash: 594d727f0469355e4f984973492873fa678116c4a03019282c8cebc7e5993250

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityOrthoAlaska, LLC

Victim entityOrthoAlaska, LLC

Incidentdiscovered Oct 12, 2022

Stated responseRetained independent cybersecurity experts to conduct a forensic investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov