MalwareHealthcareHealthcareRansomwareCapture Stored DataData ExfiltratedData EncryptedCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDFinancial accountMediumContained

Allergy Partners, PLLC

bd_29a25e665b4cb65d · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 23, 2021

Filed

Apr 26, 2021

To disclose

9 weeks

Affected

1state residents only

Linked

5 filings

Confidence

66%

Full breach record for Allergy Partners, PLLC →3 incidents on file

Allergy Partners, PLLC notified the NH AG of a security incident affecting 1 NH resident. Unauthorized access occurred Jan 12–Feb 23, 2021. Malware was deployed and documents containing patient/employee PII (SSN, DOB, DL, financial info) were acquired. Discovered Feb 23, 2021. Notification sent April 23, 2021. Credit monitoring offered.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 42 days

discovery → filing · 9 weeks / 62 days

Jan 12, 2021

Begins

Feb 23, 2021

Discovered

Apr 26, 2021

Filed

vs. sector median

2 wks faster

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Indiana State AGbd_057ae5e8dec726fb2021-04-23 · +3dVerified
Montana State AGbd_205799997e0cd5272021-04-23 · +3dVerified
Massachusetts State AGbd_642eaacc9981a6692021-04-23 · +3dVerified
HHS OCRbd_a9b66103b06d3f472021-04-23 · +3dVerified

Name: Allergy Partners, PLLC
norm: allergy partners

Name: Allergy Partners, PLLC
norm: allergy partners
Industry: Healthcarellm

Discovered: Feb 23, 2021
Breach occurred: Jan 12, 2021 – Feb 23, 2021
Undetected for: 42 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 23, 2021
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security numberDate of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 ChannelT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney General

During the incident: Took steps to secure the network
Began an investigation with the assistance of a computer forensic firm
Conducted a comprehensive review of all documents involved
Established a dedicated, toll-free call center
Offered a complimentary one-year membership to credit monitoring and identity theft protection services
Changes made: Continuing to regularly audit its systems for potential unauthorized activity
Implemented and will continue to implement enhanced network monitoring tools
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(62 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Indiana State AGApr 23 · first

Montana State AGApr 23 · first

Massachusetts State AGApr 23 · first

HHS OCRApr 23 · first

New Hampshire State AG+3d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/allergy-partners-20210426.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 26, 2021
Raw hash: 01ed028ffe47118492b810c0ff3ef84dae93fdc809173e32fd385a861dcfef4c

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityAllergy Partners, PLLC

Victim entityAllergy Partners, PLLC

Incidentdiscovered Feb 23, 2021

Stated responseTook steps to secure the network

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov