MalwareTechnologyHealthcareInformationRansomwareStolen CredentialsData EncryptedData ExfiltratedTargetedIdentity (basic)Government IDHealth (basic)Financial accountCredentialsHighContained

PracticeMax

bd_3bbfba4a3095fb69 · schema v1 · pii pii-v1

Severity

High

Discovered

May 1, 2021

Filed

Jun 10, 2022

To disclose

14 months

Affected

3,079state residents only

Linked

5 filings

Confidence

65%

Full breach record for PracticeMax →6 incidents on file

PracticeMax, a business management and IT solutions provider, disclosed a ransomware incident affecting its network. Unauthorized access occurred from April 17 to May 5, 2021, involving encrypted data and potential exfiltration from one server and limited email accounts. Affected data included names, SSNs, DOBs, health info, and financial data. PracticeMax notified the FBI, regulators, and customers starting October 19, 2021.

J jump to incidentP pin to compareR raw source

South Carolina clock✓ SC CRA notice due14 months discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 14 days

discovery → filing · 14 months / 405 days

Apr 17, 2021

Begins

May 1, 2021

Discovered

Jun 10, 2022

Filed

vs. sector median

+39 wks slower

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Maine State AGbd_41650c90bc2150322022-06-10Verified
California State AGbd_c3ddc5b7d5967e6f2022-06-10Candidate
Oregon State AGbd_f61da3d5b25643d62022-06-10Verified
New Hampshire State AGbd_63b71b27f7b47bdf2022-06-14 · +4dVerified

Name: PracticeMax
norm: practicemax
Domain: practicemax.com

Name: PracticeMax
norm: practicemax
Domain: practicemax.com
Industry: TechnologyllmHealthcarellm

Discovered: May 1, 2021
Breach occurred: Apr 17, 2021 – May 5, 2021
Undetected for: 14 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 19, 2021
Affected individuals: 3,079state-resident count only
Data types: Identity (basic)Government IDHealth (basic)Financial accountCredentials
Data elements: Social Security numberDate of birthMedical information
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified the FBINotified relevant state and federal regulatorsNotified the U.S. Department of Health and Human Services
Initial access: valid_credentials

During the incident: Disconnected our systems
Partnered with subject matter specialists to assist with our investigation
Began restoring the network and business operations
Implemented additional security policies and controls
Communicated the incident to our customers
Notified the FBI
Notified the media
Notified relevant state and federal regulators
Changes made: Reviewed existing policies and procedures
Implemented additional safeguards to further our already stringent security policies and procedures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 14 months(405 days from discovery to filing)
Compliance flags: SC CRA notice due
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Maine State AGJun 10 · first

California State AGJun 10 · first

Oregon State AGJun 10 · first

South Carolina State AGJun 10 · first · this page

New Hampshire State AG+4d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/PracticeMax.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 10, 2022
Raw hash: fdcf3f7285c9b07d3c38ee3ca04068c64eac36d2dbb49ecc78266d9720c58396

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityPracticeMax

Victim entityPracticeMax

Incidentdiscovered May 1, 2021

Stated responseDisconnected our systems

ComplianceSC CRA notice due

Extraction provenanceno artifact recorded

Source provenanceconsumer.sc.gov