Social EngineeringHealthcareHealthcarePhishingStolen CredentialsCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Government IDFinancial accountPHIHealth (basic)MediumContained

Health Quest Systems, Inc.

bd_4435fcd8dc716a37 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 1, 2018

Filed

Jan 10, 2020

To disclose

19 months

Affected

1state residents only

Linked

3 filings

Confidence

66%

Full breach record for Health Quest Systems, Inc. →3 incidents on file

Health Quest Systems, Inc. notified patients of a phishing incident where employee credentials were compromised, leading to unauthorized access to email accounts containing PHI, SSNs, and financial data. The incident was first detected in July 2018, with the investigation concluding in November 2019. Affected individuals received one year of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 19 months / 558 days

Jul 1, 2018

Discovered

Jan 10, 2020

Filed

vs. sector median

+67 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_2c07aeaadeccac382020-01-10Verified
California State AGbd_46fbe80968b6b2472020-01-10Candidate

Name: Health Quest Systems, Inc.
norm: health quest

Name: Health Quest Systems, Inc.
norm: health quest
Industry: Healthcarellm

Discovered: Jul 1, 2018
Materiality determined: —
Notification sent: Dec 19, 2019
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government IDFinancial accountPHIHealth (basic)
Data elements: Social Security numberMedical information
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Initial access: phishing_link

During the incident: Secured employee email accounts
Engaged a leading cyber security firm to assist with the investigation
Performed a comprehensive review of the voluminous contents of the email accounts
Arranged for complimentary one-year membership to Experian’s IdentityWorks credit monitoring service
Changes made: Implementation of multi-factor authentication for email
Additional procedures to further expand and strengthen security processes
Providing additional training to employees regarding phishing emails and other cybersecurity issues
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 19 months(558 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Massachusetts State AGJan 10 · first

California State AGJan 10 · first

Montana State AGJan 10 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Breach-NotificationDetails-96.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 10, 2020
Raw hash: e3d6b4a42549b754436f146cc6f5cf786d37880a8593aa1a28bd391f40c5ade9

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityHealth Quest Systems, Inc.

Victim entityHealth Quest Systems, Inc.

Incidentdiscovered Jul 1, 2018

Stated responseSecured employee email accounts

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov