MisuseHealthcareProfessional ServicesHealthcarePrivilege AbuseEmployee Data InvolvedTargetedIdentity (basic)Government IDMediumContained

Medical Management, LLC

bd_2df734a6b003fd3c · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 16, 2015

Filed

May 13, 2015

To disclose

8 weeks

Affected

10state residents only

Linked

2 filings

Confidence

66%

Full breach record for Medical Management, LLC →

Medical Management, LLC (MML), a medical billing company, notified the NH Attorney General on May 13, 2015, that a former call center employee accessed and disclosed personal information (names, DOBs, SSNs) of 10 New Hampshire residents between February 2013 and March 2015. MML terminated the employee, cooperated with federal law enforcement, and provided one year of identity theft monitoring via Kroll, Inc.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 773 days

discovery → filing · 8 weeks / 58 days

Feb 1, 2013

Begins

Mar 16, 2015

Discovered

May 13, 2015

Filed

vs. sector median

3 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

HHS OCRbd_571cc0e49d23b4982015-05-15 · +2dVerified

Name: Medical Management, LLC
norm: medical management

Name: Medical Management, LLC
norm: medical management
Industry: HealthcarellmProfessional Servicesllm

Discovered: Mar 16, 2015
Breach occurred: Feb 1, 2013 – Mar 1, 2015
Undetected for: 773 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 13, 2015
Affected individuals: 10state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Insider
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: Internal
Regulator citations: Notified federal law enforcement authorities
Initial access: insider_action

During the incident: Terminated the employee involved
Performed an extensive investigation and review
Cooperating with federal law enforcement authorities
Retained Kroll, Inc. to provide impacted individuals with one year of free identity theft monitoring services
Notifying by mail all patients whose personal information was accessed
Changes made: Terminated the employee involved
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(58 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

New Hampshire State AGMay 13 · first · this page

HHS OCR+2d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/medical-managment-20150513.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 13, 2015
Raw hash: ee9822eec30bc0b6daf9cd4339acf44e5f1edf166716994bc9ed29a4adc9ae25

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityMedical Management, LLC

Victim entityMedical Management, LLC

Incidentdiscovered Mar 16, 2015

Stated responseTerminated the employee involved

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov