HackingHealthcareHealthcareStolen CredentialsCustomer Data InvolvedGovernment IDIdentity (basic)PHIHealth (basic)CredentialsFinancial accountAuthenticationMediumContained

Southwest Family Medicine Associates

bd_51f1dec5f33c9841 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 7, 2024

Filed

Nov 7, 2024

To disclose

14 days

Affected

3state residents only

Linked

7 records

Confidence

64%

Full breach record for Southwest Family Medicine Associates →

South West Family Medicine Associates, PA reported a network security incident occurring on or about August 7, 2024. Unauthorized access to patient data, including SSNs, medical records, and financial info, was determined on October 24, 2024. Notices were sent November 7, 2024, offering IDX identity protection services.

J jump to incidentP pin to compareR raw source

Leak gap clock⏱ Leak >30d14 days discovery → filing

Incident timeline

discovery → filing · 13 weeks / 92 days

Aug 7, 2024

Begins

Aug 7, 2024

Discovered

Nov 7, 2024

Filed

vs. sector median

7 wks faster

This filing is one of 7 records about the same incident.View merged incident

A leak claim by bianlian about this victim was first seen 86 days before this filing.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitebianlianbd_18f534242947244b2024-08-13 · +85dVerified by operator

Regulatory filings (5) · sorted by filing gap

Maine State AGbd_380197d4cbfb73772024-11-07Candidate
Indiana State AGbd_84cfa0fdfd6e9f0c2024-11-07Verified
HHS OCRbd_e4512f9aba8d72c62024-11-07Verified
Massachusetts State AGbd_a4d4c4ac8b63a1032024-11-08 · +1dVerified

Show 1 more filing ↓up to 5d gap

New Hampshire State AGbd_779ec7d8d07443832024-11-12 · +5dVerified

Name: Southwest Family Medicine Associates
norm: southwest family medicine associates
Domain: sfmahealth.com

Name: Southwest Family Medicine Associates
norm: southwest family medicine associates
Domain: sfmahealth.com
Industry: Healthcarellm

Discovered: Aug 7, 2024
Breach occurred: Aug 7, 2024
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 7, 2024
Affected individuals: 3state-resident count only
Data types: Government IDIdentity (basic)PHIHealth (basic)CredentialsFinancial accountAuthentication
Data elements: Social Security numberDate of birthMedical information
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Initial access: valid_credentials

During the incident: Commenced a prompt and thorough investigation
Working very closely with external cybersecurity professionals
Offering identity theft protection services through IDX
Set up a dedicated and confidential toll-free response line
Changes made: Continually evaluates and modifies its practices and internal controls to enhance the security and privacy of your information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 14 days(14 days from discovery to filing)
Compliance flags: Leak >30d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Maine State AGNov 7 · first

Indiana State AGNov 7 · first

HHS OCRNov 7 · first

Montana State AGNov 7 · first · this page

Massachusetts State AG+1d

New Hampshire State AG+5d

Pattern: first filing Nov 7 (ME), last Nov 12 (NH) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/2025/01/Consumer-notification-letter-3.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 7, 2024
Raw hash: 618a8c3447a52367f83892382258fa38554caf124117ebf2a65e02e56f3702cc

Linked disclosures

Ransomware claims (1)

Regulatory filings (5) · sorted by filing gap

Reporting entitySouthwest Family Medicine Associates

Victim entitySouthwest Family Medicine Associates

Incidentdiscovered Aug 7, 2024

Stated responseCommenced a prompt and thorough investigation

ComplianceLeak >30d

Extraction provenanceno artifact recorded

Source provenancedojmt.gov