HackingHealthcareHealthcareSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedDelayed DiscoveryPIIPHIIdentity (basic)Government IDHealth (basic)MediumContained

Entira Family Clinics

bd_3044d05610370199 · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Jan 13, 2022

To disclose

—

Affected

Not disclosed

Linked

2 filings

Confidence

83%

Entira Family Clinics, a Minnesota-based family medicine practice, notified patients of a data security incident involving its third-party hosting and cloud IT provider, Netgain. An unauthorized party accessed Netgain's environment, potentially exposing patient name, address, Social Security number, and medical history. The breach date recorded is December 4, 2020; notice letters were sent in January 2022. Affected individuals were offered free IDX credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

Dec 4, 2020

Begins

Jan 13, 2022

Filed

This filing is one of 2 about the same incident.View merged incident

Part of Netgain Networks supply-chain incident (2021) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Maine State AGbd_f776c0fa041169072022-01-13Candidate

Name: Entira Family Clinics
norm: entira family clinics
Domain: entirafamilyclinics.com

Name: Entira Family Clinics
norm: entira family clinics
Domain: entirafamilyclinics.com
Industry: family medicine / healthcare
Industry: Healthcarellm

Discovered: —
Breach occurred: Dec 4, 2020
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: PIIPHIIdentity (basic)Government IDHealth (basic)
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain CompromiseT1530 Data from Cloud Storage Object
Threat actor: External
Third party: via Netgain
Initial access: supply_chain

During the incident: Worked with our information technology (IT) support team
Engaged a law firm specializing in cybersecurity and data privacy to investigate further
Stayed in close communication with Netgain and its breach counsel regarding Netgain's incident response and forensic investigation
Performed a security audit of the Netgain environment to insure stricter security in Netgain's cloud hosting site
Arranged for affected individuals to enroll in a complementary, online credit monitoring service provided by IDX
Changes made: Reviewing and altering our policies and procedures relating to the security of our systems and servers
Reviewing and altering information life cycle management policies and procedures
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Maine State AGJan 13 · first

California State AGJan 13 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-549954
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 13, 2022
Raw hash: ffd0019b3cd09baf5a89b3d276ca675909a89d9fa471f021bc64c54f3f3e6f18

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityEntira Family Clinics

Victim entityEntira Family Clinics

IncidentThird-Party / Supply Chain

Stated responseWorked with our information technology (IT) support team

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov