Social EngineeringHealthcareHealthcarePhishingStolen CredentialsData ExfiltratedCustomer Data InvolvedIdentity (basic)PHIHealth (basic)LowContained

The Center for Neurological and Neurodevelopmental Health

bd_42ebce2b1bb598ce · schema v1 · pii pii-v1

Severity

Low

Discovered

Nov 22, 2019

Filed

Jan 21, 2020

To disclose

9 weeks

Affected

1state residents only

Confidence

65%

Full breach record for The Center for Neurological and Neurodevelopmental Health →2 incidents on file

The Center for Neurological and Neurodevelopmental Health notified patients of unauthorized access to an employee's email account between Oct 7 and Nov 22, 2019. Patient PHI including names, DOBs, and medical records was accessed. The organization engaged a cybersecurity firm, secured the account, enabled MFA, and enhanced email security.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 46 days

discovery → filing · 9 weeks / 60 days

Oct 7, 2019

Begins

Nov 22, 2019

Discovered

Jan 21, 2020

Filed

vs. sector median

2 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1 affectedView incident

Name: The Center for Neurological and Neurodevelopmental Health
norm: the center for neurological and neurodevelopmental health

Name: The Center for Neurological and Neurodevelopmental Health
norm: the center for neurological and neurodevelopmental health
Industry: Healthcarellm

Discovered: Nov 22, 2019
Breach occurred: Oct 7, 2019 – Nov 22, 2019
Undetected for: 46 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 22, 2019
Affected individuals: 1state-resident count only
Data types: Identity (basic)PHIHealth (basic)
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: External
Initial access: phishing_link

During the incident: Took steps to secure the account
Worked with a cyber security firm to assist in our investigation
Enhanced our email security
Enabled multi-factor authentication on all email accounts
Continuing to educate employees on email security
Changes made: Enabled multi-factor authentication on all email accounts
Enhanced our email security
Educate employees on email security
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(60 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Breach-NotificationDetails-103.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 21, 2020
Raw hash: 9d28341933f4cb9069ed925f222dbbdd97989ef230920417aabe153074bd92b5

Reporting entityThe Center for Neurological and Neurodevelopmental Health

Victim entityThe Center for Neurological and Neurodevelopmental Health

Incidentdiscovered Nov 22, 2019

Stated responseTook steps to secure the account

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov