HackingHealthcareHealthcareSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)Government IDFinancial accountHealth (basic)PIIMediumActive

Hofmann Arthritis Institute PLLC

bd_3d6dcd8f59be42be · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 15, 2021

Filed

Feb 17, 2022

To disclose

13 weeks

Affected

27state residents only

Linked

6 filings

Confidence

66%

Full breach record for Hofmann Arthritis Institute PLLC →

Hofmann Arthritis Institute PLLC notified patients of a third-party vendor (AMM) cyber incident discovered Nov 15, 2021. Potentially impacted data includes names, SSNs, DOBs, driver's licenses, financial info, and medical records. No actual misuse confirmed. HAI offered IDX identity protection services.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 13 weeks / 94 days

Nov 15, 2021

Discovered

Feb 17, 2022

Filed

vs. sector median

+1 wks slower

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Indiana State AGbd_18c63d635dbb36762022-02-17Verified
Massachusetts State AGbd_2e6be3c3975db52f2022-02-15 · +2dVerified
New Hampshire State AGbd_bedeb64007eb1e042022-02-22 · +5dVerified
HHS OCRbd_9d925df8640414c72022-02-04 · +13dVerified

Show 1 more filing ↓up to 47d gap

Illinois State AGbd_8984c6cadc66c1652022-01-01 · +47dCandidate

Name: Hofmann Arthritis Institute PLLC
norm: hofmann arthritis institute

Name: Hofmann Arthritis Institute PLLC
norm: hofmann arthritis institute
Industry: Healthcarellm

Discovered: Nov 15, 2021
Materiality determined: —
Notification sent: Feb 17, 2022
Affected individuals: 27state-resident count only
Data types: Identity (basic)Government IDFinancial accountHealth (basic)PII
Data elements: Date of birthMedical information
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain Compromise
Threat actor: Partner
Regulator citations: notifying state and federal regulators
Third party: via Alta Medical Management and ECL Group, LLC
Initial access: supply_chain

During the incident: Launched an in-depth investigation
Reviewing existing security policies and procedures regarding our third-party vendors
Evaluating additional measures to further protect against similar incidents
Notifying state and federal regulators
Offering identity theft protection services through IDX
Changes made: Reviewing existing security policies and procedures regarding our third-party vendors
Evaluating additional measures to further protect against similar incidents
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 13 weeks(94 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Illinois State AGJan 1 · first

HHS OCR+34d

Massachusetts State AG+45d

Indiana State AG+47d

Montana State AG+47d · this page

New Hampshire State AG+52d

Pattern: first filing Jan 1 (IL), last Feb 22 (NH) — a 52-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/Hofmann-Arthritis-Institute-PLLC-and-Hofmann-Arthritis-Institute-of-Nevada-PLLC-Consumer-Notification-Letter.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 17, 2022
Raw hash: 9db169d9ebd91f571e68db8b9fe3606aceea217edfd2bf3bab69fef16b261900

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityHofmann Arthritis Institute PLLC

Victim entityHofmann Arthritis Institute PLLC

Incidentdiscovered Nov 15, 2021

Stated responseLaunched an in-depth investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov