Social EngineeringHealthcareProfessional ServicesHealthcarePhishingCustomer Data InvolvedIdentity (basic)Government IDHealth (basic)PHIMediumContained

Orchard Medical Consulting

bd_51b86a0c0572de64 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 30, 2020

Filed

May 5, 2020

To disclose

14 weeks

Affected

2state residents only

Linked

4 filings

Confidence

66%

Full breach record for Orchard Medical Consulting →

Orchard Medical Consulting notified Montana residents of a January 30, 2020 incident where an unauthorized individual accessed an employee's email account. Personal information, including PHI, SSNs, and DOBs, may have been accessed. The company implemented MFA, forced password changes, and offered one year of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 14 weeks / 96 days

Jan 30, 2020

Discovered

May 5, 2020

Filed

vs. sector median

+1 wks slower

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

California State AGbd_87bc5e0a982a7c952020-05-05Candidate
California State AGbd_1b27f272c568e7972020-05-28 · +23dVerified
Indiana State AGbd_6b94c7e1c97ba0d92020-07-01 · +57dVerified

Name: Orchard Medical Consulting
norm: orchard medical consulting

Name: Orchard Medical Consulting
norm: orchard medical consulting
Industry: HealthcarellmProfessional Servicesllm

Discovered: Jan 30, 2020
Materiality determined: —
Notification sent: Feb 18, 2020
Affected individuals: 2state-resident count only
Data types: Identity (basic)Government IDHealth (basic)PHI
Data elements: Social Security numberDate of birthMedical information
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid Accounts
Threat actor: External
Regulator citations: reported this incident to the appropriate government regulators
Initial access: phishing_link

During the incident: Information technology department took swift action and prevented any further unauthorized access
Conducted an extensive investigation to determine what information may have been accessed
Reported this incident to the appropriate government regulators
Arranged for you to enroll, at no cost to you, in an online credit monitoring service (myTrueIdentity) for one year provided by TransUnion Interactive
Implementing multi-factor authentication
Forcing password changes
Strengthening the security of our email tenant
Changes made: Implementing multi-factor authentication
Forcing password changes
Strengthening the security of our email tenant
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 14 weeks(96 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 3 states

View merged incident ↗

California State AGMay 5 · first

Montana State AGMay 5 · first · this page

California State AG+23d

Indiana State AG+57d

Pattern: first filing May 5 (CA), last Jul 1 (IN) — a 57-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Breach-NotificationDetails-166.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 5, 2020
Raw hash: 52e9b9eb8b2b1facaaa8a2b7c08ed8b8d60f983f75694ff9f4b5098009d263e9

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityOrchard Medical Consulting

Victim entityOrchard Medical Consulting

Incidentdiscovered Jan 30, 2020

Stated responseInformation technology department took swift action and prevented any further unauthorized access

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov