PhysicalHealthcareHealthcareTheftCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDPHIHealth (basic)MediumContained

American Esoteric Laboratories

bd_46a03b440bec7835 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Oct 15, 2017

Filed

Apr 20, 2018

To disclose

27 weeks

Affected

5state residents only

Linked

3 filings

Confidence

65%

Full breach record for American Esoteric Laboratories →3 incidents on file

American Esoteric Laboratories notified Montana residents that a stolen employee laptop on October 15, 2017 may have contained PHI and PII (SSN, DOB, health insurance). AEL disabled accounts, reported to police, and offered 1 year of credit monitoring via ID Experts. No evidence of inappropriate access was found.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 27 weeks / 187 days

Oct 15, 2017

Begins

Oct 15, 2017

Discovered

Apr 20, 2018

Filed

vs. sector median

+18 wks slower

This filing is one of 3 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

New Hampshire State AGbd_3e7ed1917bc94f5e2018-04-20Verified
Massachusetts State AGbd_b0ba48f46e67786c2018-04-20Verified

Name: American Esoteric Laboratories
norm: american esoteric laboratories

Name: American Esoteric Laboratories
norm: american esoteric laboratories
Industry: Healthcarellm

Discovered: Oct 15, 2017
Breach occurred: Oct 15, 2017
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 20, 2018
Affected individuals: 5state-resident count only
Data types: Identity (basic)Government IDPHIHealth (basic)
Data elements: Date of birthMedical information
Attack vector: Unknown
MITRE ATT&CK: T1052 Exfiltration Over Physical Medium
Threat actor: External
Regulator citations: Reported the laptop theft to the local police

During the incident: Disabled the employee’s email account
Disabled the stolen laptop’s access to its computer network
Reported the laptop theft to the local police
Secured the services of ID Experts to provide identity theft protection services
Changes made: Increasing the security of our systems and networks through the use of encryption technology
Updating our policies and procedures
Retraining our staff
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 27 weeks(187 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

New Hampshire State AGApr 20 · first

Massachusetts State AGApr 20 · first

Montana State AGApr 20 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/AEL.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 20, 2018
Raw hash: 0116c50ce3eb8768eb8942f515684de304bd76326f797c8f856837c3696aa962

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityAmerican Esoteric Laboratories

Victim entityAmerican Esoteric Laboratories

Incidentdiscovered Oct 15, 2017

Stated responseDisabled the employee’s email account

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov