HackingHealthcareHealthcareStolen CredentialsCustomer Data InvolvedEmployee Data InvolvedTargetedPHIHealth (basic)Government IDIdentity (basic)Financial accountCredentialsMediumContained

Radiation Oncology Centers of the Carolinas

bd_284f53eb97c79dd6 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 26, 2022

Filed

Sep 12, 2022

To disclose

16 weeks

Affected

1state residents only

Confidence

66%

Full breach record for Radiation Oncology Centers of the Carolinas →2 incidents on file

Radiation Oncology Centers of the Carolinas, Inc. (ROCC) notified the NH AG of a data security incident affecting 1 NH resident. Unauthorized access to two email accounts occurred around Jan 11, 2022, discovered May 25, 2022. Exposed data included PHI, SSNs, driver's licenses, and financial info. ROCC engaged forensic vendors, reset passwords, implemented MFA, and offered 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 74 days

discovery → filing · 24 weeks / 170 days

Jan 11, 2022

Begins

Mar 26, 2022

Discovered

Sep 12, 2022

Filed

vs. sector median

+5 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1 affectedView incident

Name: Wilson Elser Moskowitz Edelman and Dicker LLP
norm: wilson elser moskowitz edelman dicker

Name: Radiation Oncology Centers of the Carolinas
norm: radiation oncology centers of the carolinas
Industry: Healthcarellm

Discovered: Mar 26, 2022
Breach occurred: Jan 11, 2022
Undetected for: 74 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 1, 2022
Affected individuals: 1state-resident count only
Data types: PHIHealth (basic)Government IDIdentity (basic)Financial accountCredentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: External
Regulator citations: Notified New Hampshire Attorney General
Initial access: valid_credentials

During the incident: Engaged third-party forensic vendors to investigate
Changed all passwords within its environment
Implemented multifactor authentication
Offered complimentary identity theft and credit monitoring services for twelve (12) months
Changes made: Changed all passwords within its environment
Implemented multifactor authentication
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 16 weeks(110 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/radiation-oncology-centers-carolinas-20220912.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 12, 2022
Raw hash: 857b626db1c472b7a33797d0771370227d55245758bb86dfaba8b3b8feefabc4

Reporting entityWilson Elser Moskowitz Edelman and Dicker LLP

Victim entityRadiation Oncology Centers of the Carolinas

Incidentdiscovered Mar 26, 2022

Stated responseEngaged third-party forensic vendors to investigate

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov