Social EngineeringHealthcareHealthcarePhishingBECData ExfiltratedCustomer Data InvolvedEmployee Data InvolvedMulti-Stage ChainIdentity (basic)Government IDFinancial accountPHIHealth (basic)MediumResolved

Florida Digestive Health Specialists

bd_43339b124f149c6c · schema v1 · pii pii-v1

Severity

Medium

Discovered

Dec 16, 2020

Filed

Dec 27, 2021

To disclose

13 months

Affected

2state residents only

Linked

6 filings

Confidence

65%

Full breach record for Florida Digestive Health Specialists →4 incidents on file

Florida Digestive Health Specialists, LLP notified Montana AG of a phishing incident where employee email accounts were compromised, leading to Business Email Compromise (misrouted funds) and exfiltration of patient PHI including SSNs, DOBs, and medical records. Incident discovered Dec 16, 2020; notices sent Dec 27, 2021. Remediation included MFA, password resets, and credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 13 months / 376 days

Dec 16, 2020

Begins

Dec 16, 2020

Discovered

Dec 27, 2021

Filed

vs. sector median

+41 wks slower

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Maine State AGbd_712d5b3d2f1de3c42021-12-27Verified
New Hampshire State AGbd_9e507c668ab0891f2021-12-27Verified
HHS OCRbd_af289138988b1d232021-12-27Verified
Indiana State AGbd_dac3210300c716bd2021-12-27Verified

Show 1 more filing ↓up to 9d gap

Massachusetts State AGbd_e38f5892d6aa6b8e2022-01-05 · +9dVerified

Name: Florida Digestive Health Specialists
norm: florida digestive health specialists

Name: Florida Digestive Health Specialists
norm: florida digestive health specialists
Industry: Healthcarellm

Discovered: Dec 16, 2020
Breach occurred: Dec 16, 2020 – Dec 21, 2020
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 27, 2021
Affected individuals: 2state-resident count only
Data types: Identity (basic)Government IDFinancial accountPHIHealth (basic)
Data elements: Social Security numberDate of birthMedical information
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Initial access: phishing_link

During the incident: Engaged Clark Hill PLC to assist in the investigation
Engaged Kivu, a nationally-recognized, third-party computer forensics firm, to further assist in the investigation
Reset passwords
Enabled multi-factor authentication in our email environment
Re-trained its employees on the proper handling of protected health information
Deployed additional security controls
Strengthened password protocols
Reconfigured our firewall
Changes made: Enabled multi-factor authentication throughout our IT systems
Deployed additional security controls
Strengthened password protocols
Reconfigured our firewall
Re-trained its employees on the proper handling of protected health information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 13 months(376 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Maine State AGDec 27 · first

New Hampshire State AGDec 27 · first

HHS OCRDec 27 · first

Indiana State AGDec 27 · first

Montana State AGDec 27 · first · this page

Massachusetts State AG+9d

Pattern: first filing Dec 27 (ME), last Jan 5 (MA) — a 9-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-Notification-29.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 27, 2021
Raw hash: 53c69350ad2aa10e5c3b0feee0a6bb8d59e9f8c2a6aad08a20c1136132f1790c

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityFlorida Digestive Health Specialists

Victim entityFlorida Digestive Health Specialists

Incidentdiscovered Dec 16, 2020

Stated responseEngaged Clark Hill PLC to assist in the investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov