MalwareHealthcareHealthcareRansomwareData EncryptedData ExfiltratedIdentity (basic)Government IDHealth (basic)PHIMediumContained

Ascend Clinical, LLC

bd_36cb93c68b6198c6 · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 31, 2020

Filed

Nov 3, 2020

To disclose

22 weeks

Affected

514state residents only

Linked

10 filings

Confidence

64%

Full breach record for Ascend Clinical, LLC →

Ascend Clinical LLC, a clinical reference laboratory, notified patients of a data security incident detected on May 31, 2020. An unauthorized user accessed and downloaded files containing PII and PHI, including names, addresses, SSNs, and medical data. Data was encrypted via ransomware. Ascend engaged Kroll for forensic investigation and identity monitoring services for affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 22 weeks / 156 days

May 31, 2020

Discovered

Nov 3, 2020

Filed

vs. sector median

+10 wks slower

This filing is one of 10 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (9) · sorted by filing gap

Indiana State AGbd_9b91d1eadde4c40b2020-11-03Verified
Massachusetts State AGbd_0c3f5760dbb44d4b2020-10-29 · +5dVerified by operator
Washington State AGbd_80d721f819ea5e742020-10-27 · +7dVerified
Oregon State AGbd_affdc1609c7f455a2020-10-27 · +7dVerified

Show 5 more filings ↓up to 76d gap

California State AGbd_43c5891ca65999ef2020-10-26 · +8dVerified
New Hampshire State AGbd_6f928c60b9b634a02020-10-26 · +8dVerified
Maine State AGbd_6882f24b5e369f8a2020-10-23 · +11dVerified
HHS OCRbd_fc6b4a302719f9a02020-10-19 · +15dVerified by operator
Montana State AGbd_31fe7e79e05ba1e32020-08-19 · +76dCandidate

Name: Ascend Clinical, LLC
norm: ascend clinical
Domain: labcheck5.com

Name: Ascend Clinical, LLC
norm: ascend clinical
Domain: labcheck5.com
Industry: Healthcarellm

Discovered: May 31, 2020
Materiality determined: —
Notification sent: —
Affected individuals: 514state-resident count only
Data types: Identity (basic)Government IDHealth (basic)PHI
Data elements: Medical information
Attack vector: Unauthorized Access
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified federal and local law enforcement authoritiesNotifying state and federal agencies responsible for enforcing privacy laws

During the incident: Notified federal and local law enforcement authorities
Retained a leading third party cybersecurity firm to investigate the nature and scope of the incident
Notifying state and federal agencies responsible for enforcing privacy laws
Worked diligently with forensic consultants to restore and secure the impacted systems
Installation of forensic tools on all systems
Isolation of impacted systems
Implemented countermeasures and further upgraded its security systems
Secured the services of Kroll to provide identity monitoring at no cost to you for one year
Changes made: Installation of forensic tools on all systems
Isolation of impacted systems
Implemented countermeasures and further upgraded its security systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 22 weeks(156 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 10 filings · 9 states

View merged incident ↗

Montana State AGAug 19 · first

HHS OCR+61d

Maine State AG+65d

California State AG+68d

New Hampshire State AG+68d

Washington State AG+69d

Oregon State AG+69d

Massachusetts State AG+71d

Indiana State AG+76d

South Carolina State AG+76d · this page

Pattern: first filing Aug 19 (MT), last Nov 3 (SC) — a 76-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2020/AscindClinical.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 3, 2020
Raw hash: 1864f3a0dbd899a031b1337dc804d9198587222f754d2dc86cddabd9bfbb6582

Linked disclosures

Regulatory filings (9) · sorted by filing gap

Reporting entityAscend Clinical, LLC

Victim entityAscend Clinical, LLC

Incidentdiscovered May 31, 2020

Stated responseNotified federal and local law enforcement authorities

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceconsumer.sc.gov