Social EngineeringHealthcareProfessional ServicesHealthcarePhishingCustomer Data InvolvedPIIIdentity (basic)Government IDFinancialMediumContained

Management Health Systems, Inc.

bd_39230c750fe32fd2 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 8, 2016

Filed

Mar 18, 2016

To disclose

10 days

Affected

6state residents only

Linked

2 filings

Confidence

67%

Full breach record for Management Health Systems, Inc. →

Management Health Systems (MedPro Healthcare Staffing) reported a phishing incident on March 8, 2016, where an employee sent W-2 forms containing PII and SSNs to an attacker impersonating the CEO. 6 NH residents were notified on March 18, 2016. Law enforcement was notified. Credit monitoring was offered.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 10 days

Mar 8, 2016

Discovered

Mar 18, 2016

Filed

vs. sector median

8 wks faster

This filing is one of 2 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_ec2957309994a5a22016-03-24 · +6dVerified

Name: Wilson, Elser, Moskowitz, Edelman & Dicker LLP
norm: wilson elser moskowitz edelman dicker
Domain: wilsonelser.com

Name: Management Health Systems, Inc.
norm: management health
Also named: Management Health Systems, Inc.dba oflegal entity
MedPro Healthcare Staffingdba oftrade name
Industry: HealthcarellmProfessional Servicesllm

Discovered: Mar 8, 2016
Materiality determined: —
Notification sent: Mar 18, 2016
Affected individuals: 6state-resident count only
Data types: PIIIdentity (basic)Government IDFinancial
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified law enforcement (FBI) and the IRS
Initial access: phishing_link

During the incident: Notified law enforcement and the IRS of the incident
Continuing to cooperate with their investigation
Notified the affected individuals
Offered them free credit monitoring and identity protection services for 12 months at no cost to them
Changes made: Additional training of employees
Revising our policies and procedures regarding the handling of personal information
Strengthening IT procedures to further block spoofing emails like the one used in this incident
Conducting a full network security audit to identify known malware
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 10 days(10 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

New Hampshire State AGMar 18 · first · this page

Massachusetts State AG+6d

Pattern: first filing Mar 18 (NH), last Mar 24 (MA) — a 6-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/management-health-20160318.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 18, 2016
Raw hash: 90270d9787c45dfce273b9e6c813cf6e94d5b72ca52a0957d0a96e9e7c05d2a2

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityWilson, Elser, Moskowitz, Edelman & Dicker LLP

Victim entityManagement Health Systems, Inc.

Incidentdiscovered Mar 8, 2016

Stated responseNotified law enforcement and the IRS of the incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov