Social EngineeringHealthcareHealthcarePhishingStolen CredentialsData ExfiltratedTargetedIdentity (basic)Government IDHealth (basic)Financial accountMediumContained

Christie Business Holdings Company, P.C.

bd_41094ec233626921 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 27, 2022

Filed

Mar 25, 2022

To disclose

8 weeks

Affected

115state residents only

Linked

5 filings

Confidence

65%

Full breach record for Christie Business Holdings Company, P.C. →

Christie Business Holdings Company, P.C. (Christie Clinic) notified individuals of unauthorized access to a single business email account between July 14 and August 19, 2021. The actor intercepted a business transaction. Potentially impacted data includes names, addresses, SSNs, medical info, and health insurance info. No evidence of identity theft was found. Credit monitoring offered.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 197 days

discovery → filing · 8 weeks / 57 days

Jul 14, 2021

Begins

Jan 27, 2022

Discovered

Mar 25, 2022

Filed

vs. sector median

4 wks faster

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Washington State AGbd_a1eb3d1e4ac146d32022-03-25Verified by operator
HHS OCRbd_c5da4d2f50aa63532022-03-25Verified
Massachusetts State AGbd_d79d45782a7de8d72022-03-25Verified
New Hampshire State AGbd_bbeab82432f036e22022-03-29 · +4dVerified

Name: Christie Business Holdings Company, P.C.
norm: christie business
Domain: christieclinic.com

Name: Christie Business Holdings Company, P.C.
norm: christie business
Domain: christieclinic.com
Industry: Healthcarellm

Discovered: Jan 27, 2022
Breach occurred: Jul 14, 2021 – Aug 19, 2021
Undetected for: 197 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 25, 2022
Affected individuals: 115state-resident count only
Data types: Identity (basic)Government IDHealth (basic)Financial account
Data elements: Social Security numberMedical information
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Regulator citations: notified federal law enforcement
Initial access: phishing_link

During the incident: Notified federal law enforcement
Engaged a leading data forensics firm
Launched an internal investigation
Secured the impacted account
Changes made: Implemented additional safeguards for Christie Clinic and its patients
Offering complimentary credit monitoring and identity protection services through Experian
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(57 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Washington State AGMar 25 · first

HHS OCRMar 25 · first

Massachusetts State AGMar 25 · first

Montana State AGMar 25 · first · this page

New Hampshire State AG+4d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/Christie-Business-Holdings-Company-P.C.-Consumer-Notification-Letter.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 25, 2022
Raw hash: 8457510f4611f8bb1357b99ddea527c0941702a7997f79e0855cbe3c00f7e86e

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityChristie Business Holdings Company, P.C.

Victim entityChristie Business Holdings Company, P.C.

Incidentdiscovered Jan 27, 2022

Stated responseNotified federal law enforcement

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov