MARYLANDMalwareHealthcareHealthcareRansomwareCapture Stored DataData ExfiltratedData EncryptedRansom DemandedCustomer Data InvolvedIdentity (basic)Government IDHealth (basic)Financial accountMediumResolved

Man Alive, Inc. and Lane Treatment Center, LLC

bd_2abb7f3a8851fdbf · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 8, 2016

Filed

Sep 8, 2016

To disclose

—

Affected

860

Confidence

97%

Full breach record for Man Alive, Inc. and Lane Treatment Center, LLC →

Man Alive, Inc. and Lane Treatment Center, LLC (MD) reported to HHS on 2016-09-08 a Hacking/IT Incident affecting 860 individuals. A cyber-attacker gained access via remote access, installed ransomware on an employee's desktop computer, and accessed the electronic patient record system, downloading patient profiles containing names, birthdates, SSNs, drug dosage info, insurance IDs, addresses, phone numbers, and employment/demographic data. Breached info located on Desktop Computer and Electronic Medical Record system. FBI was notified; corrective actions confirmed by OCR.

J jump to incidentP pin to compareR raw source

HIPAA clock✓ HHS report on time

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · ≤1 day / 0 days

Sep 8, 2016

Begins

Sep 8, 2016

Discovered

Sep 8, 2016

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed860 affectedView incident

Name: Man Alive, Inc. and Lane Treatment Center, LLC
norm: man alive inc and lane treatment center
Industry: Health Care Services

Name: Man Alive, Inc. and Lane Treatment Center, LLC
norm: man alive inc and lane treatment center
Industry: Health Care Services
Industry: Healthcaresource default

Discovered: Sep 8, 2016
Breach occurred: Sep 8, 2016
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 860nationwide
Data types: Identity (basic)Government IDHealth (basic)Financial account
HHS breach type: Hacking / IT incident
Where the data lived: Desktop computerElectronic medical record
Covered-entity type: Healthcare provider
Attack vector: Unauthorized Access
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1078 Valid AccountsT1041 Exfiltration Over C2 ChannelT1133 External Remote Services
Threat actor: ExternalFinancial
Regulator citations: HHS OCRFBI
Initial access: external_remote_services

During the incident: Removed infected computer from network
Restored maliciously encrypted data
Notified HHS, affected individuals, media, FBI, and vendor partners
Posted substitute notice on website
Disabled all user remote access (except select vendors)
Implemented security appliance with gateway-level virus scanning, protocol blocking, and firewall
Strengthened password complexity requirements for all users
Changes made: Deployed network security appliance with virus scanning and firewall capabilities
Disabled broad remote access; limited to vetted vendors only
Enhanced password complexity policy
Source: Quoted from the filing itself, not independently verified.

Compliance flags: HHS report on timeHHS notified
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: Sep 8, 2016
→ Notified: not extracted
— 60 days HHS report on time
HIPAA
Discovered: Sep 8, 2016
→ Notified: not extracted
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: Sep 8, 2016 → Notified: not extracted	—	60 days	HHS report on time
HIPAA	Discovered: Sep 8, 2016 → Notified: not extracted	—	regulatory submission	HHS notified

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Sep 8, 2016
Raw hash: 8708f21263fd20637eedb89e15be743f191182852978c7daf8d6901ec0263771

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html2.3 KB

Download View at source

Reporting entityMan Alive, Inc. and Lane Treatment Center, LLC

Victim entityMan Alive, Inc. and Lane Treatment Center, LLC

Incidentdiscovered Sep 8, 2016

Stated responseRemoved infected computer from network

ComplianceHHS report on time

Extraction provenanceno artifact recorded

Source provenanceocrportal.hhs.gov

Source filing