HackingHealthcareTechnologyHealthcareData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDHealth (basic)PHIMediumContained

Psych Care Consultants

bd_510eb8b46fec518d · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 26, 2021

Filed

Nov 26, 2021

To disclose

13 weeks

Affected

7state residents only

Confidence

66%

Full breach record for Psych Care Consultants →

Psych Care Consultants experienced a data breach where an unauthorized third party accessed a QRS-hosted patient portal server between August 23-26, 2021. The incident exposed PHI including names, SSNs, DOBs, and medical data. QRS took the server offline, engaged forensic investigators, and implemented MFA and SIEM.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 3 days

discovery → filing · 13 weeks / 92 days

Aug 23, 2021

Begins

Aug 26, 2021

Discovered

Nov 26, 2021

Filed

vs. sector median

+2 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed7 affectedView incident

Name: QRS, Inc.
norm: QRS

Name: Psych Care Consultants
norm: psych care consultants
Industry: HealthcarellmTechnologyllm

Discovered: Aug 26, 2021
Breach occurred: Aug 23, 2021 – Aug 26, 2021
Undetected for: 3 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 7state-resident count only
Data types: Identity (basic)Government IDHealth (basic)PHI
Data elements: Social Security numberDate of birthMedical information
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: External
Regulator citations: provided an initial notification of the incident to Psych Care Consultants on September 7, 2021provided further notification of the incident to Psych Care Consultants on or about October 1, 2021
Initial access: exploit_public_facing

During the incident: Took the server offline
Began an investigation
Engaged a forensic security firm to confirm the security of our network, analyze the incident, and determine the extent of the PHI that may have been accessed or acquired by the third party
Changes made: Implemented multifactor authentication on core QRS systems for key administrators
Implemented a Security Information and Event Management System (SIEM)
Reviewing and updating its information security policies
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 13 weeks(92 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-Notification-23.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 26, 2021
Raw hash: d9bbb61c034b57bd6cdbbf23ba7d957da6d896a30a8262eeb8a782134fb56c54

Reporting entityQRS, Inc.

Victim entityPsych Care Consultants

Incidentdiscovered Aug 26, 2021

Stated responseTook the server offline

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov