AZMalwareHealthcareHealthcareRansomwareCustomer Data InvolvedData EncryptedHEALTH_BASICIDENTITY_BASICMediumResolved
Maffi Clinics
bd_3305fcc273c2906f · schema v1 · pii pii-v1
Full breach record for Maffi Clinics →On September 11, 2018, Maffi Clinics (AZ) was the victim of a ransomware attack on its network server affecting 10,465 patients' clinical and demographic information. Maffi promptly terminated the unauthorized access point, isolated and removed the ransomware, and restored all data. No evidence was found that data was viewed or downloaded. Patient notifications were sent on February 14, 2019. OCR closed its investigation after determining Maffi is not a HIPAA covered entity or business associate.
HIPAA clockDiscovered Sep 11, 2018 → Notified Feb 14, 2019156d ✗ HIPAA 60-day late25 weeks discovery → filing
⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed10,465 affectedView incident
Source provenance
- Source URL
- https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
- Filed at
- Mar 6, 2019
- Raw hash
- 7ff30157e728a2de5a3dcfa31d8163b002fa9e83bbb6fdba7b027720763b6a8a
Source filing
AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.
Reporting entity
- Name
- Maffi Clinicsnorm: maffi clinics
- Industry
- Health Care Services
Victim entity
- Name
- Maffi Clinicsnorm: maffi clinics
- Industry
- Health Care Services
- Industry
- Healthcaresource default
Incident
- Discovered
- Sep 11, 2018
- Materiality determined
- —
- Notification sent
- Feb 14, 2019
- Affected individuals
- 10,465
- Data types
- HEALTH_BASICIDENTITY_BASIC
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1486 Data Encrypted for Impact
- Threat actor
- ExternalFinancial
- Regulator citations
- OCR investigation opened; OCR determined Maffi Clinics is not a HIPAA covered entity or business associate and closed the investigation.
Compliance
- Time to disclose
- 25 weeks(176 days from discovery to filing)
- Compliance flags
- HIPAA 60-day late · 156dHHS notified · 156d
- Discovery-date grounding
- occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
- Clock breakdown
Statute Window Elapsed Threshold Status HIPAA Discovered: Sep 11, 2018→ Notified: Feb 14, 2019156d 60 days HIPAA 60-day late HIPAA Discovered: Sep 11, 2018→ Notified: Feb 14, 2019156d regulatory submission HHS notified
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.