AccidentalTechnologyHealthcareInformationMisconfigurationCustomer Data InvolvedGovernment IDPIIMediumResolved

Ingenix

bd_3eaebb2b06d3a725 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 30, 2010

Filed

Jan 6, 2011

To disclose

5 weeks

Affected

142state residents only

Linked

2 filings

Confidence

66%

Full breach record for Ingenix →

Ingenix, Inc. notified the NH Attorney General of a data error where provider SSNs were displayed in provider search results. The incident occurred between 2005 and Nov 2010. 142 NH providers were notified starting Dec 29, 2010. Ingenix removed the data and offered credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 2159 days

discovery → filing · 5 weeks / 37 days

Jan 1, 2005

Begins

Nov 30, 2010

Discovered

Jan 6, 2011

Filed

vs. sector median

13 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_926fd7735e2bde002011-01-07 · +1dVerified

Name: Ingenix
norm: ingenix
Domain: ingenix.com

Name: Ingenix
norm: ingenix
Domain: ingenix.com
Industry: TechnologyllmHealthcarellm

Discovered: Nov 30, 2010
Breach occurred: Jan 1, 2005 – Nov 30, 2010
Undetected for: 2,159 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 29, 2010
Affected individuals: 142state-resident count only
Data types: Government IDPII
Data elements: Social Security number
Attack vector: Misconfiguration
MITRE ATT&CK: T1119 Automated Collection

During the incident: Removed the SSNs from the data used by these provider search sites
Worked with the health plans to avoid a reoccurrence of the error
Began making written notification via USPS to 142 New Hampshire providers
Provided a one year membership in ID Experts’ identity theft protection and restoration program
Offered 12 months of credit monitoring
Offered fraud restoration services and a $20,000 insurance reimbursement component
Changes made: Removed the SSNs from the data used by these provider search sites
Worked with the health plans to avoid a reoccurrence of the error
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(37 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

New Hampshire State AGJan 6 · first · this page

Massachusetts State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/ingenix-20110106.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 6, 2011
Raw hash: 28d50993d08254c9f64b9cd8f6c0e1bfb8ae366476438e19565ddc0ed94c8b0f

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityIngenix

Victim entityIngenix

Incidentdiscovered Nov 30, 2010

Stated responseRemoved the SSNs from the data used by these provider search sites

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov