MalwareHealthcareHealthcareRansomwareData EncryptedData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDHealth (basic)PHIHighContained

MedPeds Associates of Sarasota

bd_4e606e92c99d6162 · schema v1 · pii pii-v1

Severity

High

Discovered

Sep 2, 2025

Filed

Mar 16, 2026

To disclose

28 weeks

Affected · nationwide

21,43015 in this filing

Linked

5 filings

Confidence

65%

Full breach record for MedPeds Associates of Sarasota →

MedPeds Associates of Sarasota, a healthcare provider, disclosed a ransomware incident on September 2, 2025, affecting 21,430 individuals. The breach encrypted patient data and resulted in the viewing of PHI, names, DOBs, and addresses. The company engaged forensic investigators and the FBI, and sent notifications on March 16, 2026.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Sep 2, 2025 → Filed with AG Mar 16, 2026195d ✗ ME AG >90d28 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 28 weeks / 195 days

Sep 2, 2025

Begins

Sep 2, 2025

Discovered

Mar 16, 2026

Filed

vs. sector median

+15 wks slower

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Nebraska State AGbd_4bb5a1b5d650cfb92026-03-16Verified
Indiana State AGbd_bf13059c2b0bb4a62026-03-16Verified
Vermont State AGbd_f5fef79475594d252026-03-16Verified
HHS OCRbd_693ed259aa941ef62026-03-13 · +3dVerified

Name: MedPeds Associates of Sarasota
norm: medpeds associates of sarasota

Name: MedPeds Associates of Sarasota
norm: medpeds associates of sarasota
Industry: Healthcarellm

Discovered: Sep 2, 2025
Breach occurred: Sep 2, 2025
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 16, 2026
Affected individuals: 21,430state + nationwide
Data types: Identity (basic)Government IDHealth (basic)PHI
Data elements: Date of birthMedical information
Attack vector: Unauthorized Access
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: Notified the FBI
Initial access: exploit_public_facing

During the incident: Worked to restore our computer system with a forensic firm
Contacted the FBI and worked with their cyber security department
Implemented additional safeguards to improve data security on our web server infrastructure
Changes made: Improved our security and protect our system from further unauthorized access
Implemented additional safeguards to improve data security on our web server infrastructure
Taking additional steps to protect patient related data from theft or similar criminal activity in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 28 weeks(195 days from discovery to filing)
Compliance flags: ME AG >90d · 195dME resident >60d · 195d
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Sep 2, 2025
→ Filed with AG: Mar 16, 2026
195d 90 days ME AG >90d
Maine
Discovered: Sep 2, 2025
→ Notified: Mar 16, 2026
195d 60 days (analyst band; statutory cap is 30 days) ME resident >60d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Sep 2, 2025 → Filed with AG: Mar 16, 2026	195d	90 days	ME AG >90d
Maine	Discovered: Sep 2, 2025 → Notified: Mar 16, 2026	195d	60 days (analyst band; statutory cap is 30 days)	ME resident >60d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

HHS OCRMar 13 · first

Nebraska State AG+3d

Indiana State AG+3d

Vermont State AG+3d

Maine State AG+3d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/43a9ee92-af3a-4421-b653-ab550d8a2120.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 16, 2026
Raw hash: 34a509fc5e28a886a8892a73c2994ccdf7d14c6b96971b6c0dd0027526f13cf8

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityMedPeds Associates of Sarasota

Victim entityMedPeds Associates of Sarasota

Incidentdiscovered Sep 2, 2025

Stated responseWorked to restore our computer system with a forensic firm

ComplianceME AG >90d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov