HackingHealthcareHealthcareStolen CredentialsData ExfiltratedIdentity (basic)Government IDFinancial accountHealth (basic)PHIMediumContained

Cardiovascular Associates Holdings, LP

bd_489906bb2eebc73f · schema v1 · pii pii-v1

Severity

Medium

Discovered

Dec 5, 2022

Filed

Feb 3, 2023

To disclose

9 weeks

Affected

Not disclosed

Linked

10 filings

Confidence

67%

Full breach record for Cardiovascular Associates Holdings, LP →

Cardiovascular Associates notified patients of a data breach where unauthorized access occurred between Nov 28 and Dec 5, 2022. Personal information including names, SSNs, medical records, and financial data was accessed. A forensic firm was engaged, and affected individuals were offered credit monitoring.

J jump to incidentP pin to compareR raw source

Vermont clock⏱ VT AG >14 bday9 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 7 days

discovery → filing · 9 weeks / 60 days

Nov 28, 2022

Begins

Dec 5, 2022

Discovered

Feb 3, 2023

Filed

vs. sector median

3 wks faster

This filing is one of 10 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (9) · sorted by filing gap

California State AGbd_3101fb359642d7d32023-02-03Verified
Massachusetts State AGbd_a91006042cd09d5c2023-02-03Verified
HHS OCRbd_b0c6fa9187e34f262023-02-03Verified
Montana State AGbd_bfd43f9919ac6f722023-02-03Verified

Show 5 more filings ↓up to 42d gap

South Carolina State AGbd_f4f1c65f262f28192023-02-03Verified
New Hampshire State AGbd_cd85f8eca68034242023-02-06 · +3dVerified
Indiana State AGbd_1846d59f2e2287b92023-03-17 · +42dVerified
California State AGbd_1e18382a04b09a262023-03-17 · +42dVerified
Maine State AGbd_c613160ae6c07cfd2023-03-17 · +42dVerified

Name: Cardiovascular Associates Holdings, LP
norm: cardiovascular associates

Name: Cardiovascular Associates Holdings, LP
norm: cardiovascular associates
Industry: Healthcarellm

Discovered: Dec 5, 2022
Breach occurred: Nov 28, 2022 – Dec 5, 2022
Undetected for: 7 daysoccurrence → discovery
Materiality determined: Feb 3, 2023
Notification sent: Feb 3, 2023
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDFinancial accountHealth (basic)PHI
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Initial access: valid_credentials

During the incident: Steps were quickly taken to restrict further unauthorized activity
An investigation of the incident was immediately launched
A national forensic firm was engaged to assist with investigation and remediation efforts
Offered identity monitoring for a period of 12/24 months, at no cost to you, through IDX
Changes made: Security and monitoring capabilities are being enhanced
Systems are being hardened as appropriate to minimize the risk of any similar incident in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(60 days from discovery to filing)
Compliance flags: VT AG >14 bday
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 10 filings · 9 states

View merged incident ↗

California State AGFeb 3 · first

Massachusetts State AGFeb 3 · first

HHS OCRFeb 3 · first

Montana State AGFeb 3 · first

South Carolina State AGFeb 3 · first

Vermont State AGFeb 3 · first · this page

New Hampshire State AG+3d

Indiana State AG+42d

California State AG+42d

Maine State AG+42d

Pattern: first filing Feb 3 (CA), last Mar 17 (ME) — a 42-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ago.vermont.gov/document/2023-02-03-cardiovascular-associates-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 3, 2023
Raw hash: 17941d5c5cf6d8d1662df5331b4fe1262d4356b1fa6351248019e3217d63aae8

Linked disclosures

Regulatory filings (9) · sorted by filing gap

Reporting entityCardiovascular Associates Holdings, LP

Victim entityCardiovascular Associates Holdings, LP

Incidentdiscovered Dec 5, 2022

Stated responseSteps were quickly taken to restrict further unauthorized activity

ComplianceVT AG >14 bday

Extraction provenanceno artifact recorded

Source provenanceago.vermont.gov