AccidentalTechnologyHealthcareInformationMisdeliveryCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDMinorMediumResolved

Standard Modern Company, Inc.

bd_31859e4db90c87fa · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 24, 2021

Filed

Jul 26, 2021

To disclose

9 weeks

Affected

1state residents only

Linked

4 filings

Confidence

66%

Full breach record for Standard Modern Company, Inc. →

Standard Modern Company, Inc. notified the NH AG of a data incident where MassHealth member notices were mailed between May 10-18, 2021, with incorrect addresses due to an internal program error. Discovered May 24, 2021. Affected data included names, SSN last 4 digits, DOB, and member IDs. 1 NH resident affected. Notifications sent July 20, 2021, including credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 14 days

discovery → filing · 9 weeks / 63 days

May 10, 2021

Begins

May 24, 2021

Discovered

Jul 26, 2021

Filed

vs. sector median

2 wks faster

This filing is one of 4 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Massachusetts State AGbd_799ce6a7379da1ef2021-07-26Verified
Maine State AGbd_c3b295771397e1d42021-07-26Verified
HHS OCRbd_079d93e07d65acdd2021-07-20 · +6dVerified

Name: Standard Modern Company, Inc.
norm: standard modern
Domain: standardmodern.com

Name: Standard Modern Company, Inc.
norm: standard modern
Domain: standardmodern.com
Industry: TechnologyllmHealthcarellm

Discovered: May 24, 2021
Breach occurred: May 10, 2021 – May 18, 2021
Undetected for: 14 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 20, 2021
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government IDMinor
Data elements: Social Security numberDate of birth
Attack vector: Misconfiguration
MITRE ATT&CK: T1074 Data Staged
Regulator citations: Notified the U.S. Department of Health and Human Services Office for Civil Rights

During the incident: Stopped mailing to MassHealth members
Began an internal investigation
Suspended use of the internal program
Implemented additional safeguards and procedures
Mailed the correct information to affected MassHealth members
Worked with a leading privacy and security law firm
Notified the U.S. Department of Health and Human Services Office for Civil Rights
Posted a notice on its website
Notified media in relevant jurisdictions
Provided two years of triple bureau credit monitoring and cyber monitoring services
Changes made: Implemented additional safeguards and procedures to prevent this issue from reoccurring
Stopped using the program that caused the error
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(63 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 3 states

View merged incident ↗

HHS OCRJul 20 · first

Massachusetts State AG+6d

Maine State AG+6d

New Hampshire State AG+6d · this page

Pattern: first filing Jul 20 (MA), last Jul 26 (NH) — a 6-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/standard-modern-company-20210726.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 26, 2021
Raw hash: 0767152563e0433bca4f19bea6f04fcc9e64a098e7e2c5d14d205cb7c9ff6931

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityStandard Modern Company, Inc.

Victim entityStandard Modern Company, Inc.

Incidentdiscovered May 24, 2021

Stated responseStopped mailing to MassHealth members

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov