HackingHealthcareHealthcareStolen CredentialsCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDHealth (basic)MinorMediumContained

Valley Anesthesiology Consultants, Inc.

bd_536d1c17f10a5714 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 13, 2016

Filed

Aug 12, 2016

To disclose

9 weeks

Affected

586state residents only

Linked

6 filings

Confidence

66%

Full breach record for Valley Anesthesiology Consultants, Inc. →

Valley Anesthesiology and Pain Consultants (VAPC) notified patients of unauthorized access to computer systems on March 30, 2016, discovered June 13, 2016. Systems may contain PHI, SSNs, and names. Forensics found no evidence of access but could not rule it out. VAPC hired forensic firm, notified law enforcement, and offered credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 75 days

discovery → filing · 9 weeks / 60 days

Mar 30, 2016

Begins

Jun 13, 2016

Discovered

Aug 12, 2016

Filed

vs. sector median

2 wks faster

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Oregon State AGbd_528c463d467fa4dd2016-08-12Candidate
California State AGbd_62ea62ba052757f32016-08-12Verified
Massachusetts State AGbd_6c09aa6edcca020f2016-08-12Verified
Washington State AGbd_e78919fc3bf148082016-08-12Verified

Show 1 more filing ↓

HHS OCRbd_ebf01ca47ea1047c2016-08-12Verified

Name: Valley Anesthesiology Consultants, Inc.
norm: valley anesthesiology consultants

Name: Valley Anesthesiology Consultants, Inc.
norm: valley anesthesiology consultants
Industry: Healthcarellm

Discovered: Jun 13, 2016
Breach occurred: Mar 30, 2016
Undetected for: 75 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 8, 2016
Affected individuals: 586state-resident count only
Data types: Identity (basic)Government IDHealth (basic)Minor
Data elements: Social Security numberMedical information
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notifying law enforcement
Initial access: valid_credentials

During the incident: Hired a leading forensics firm to assist us
Notifying law enforcement
Changes made: Reviewing our security processes
Strengthening our network firewalls
Continuing to incorporate best practices in IT security
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(60 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Oregon State AGAug 12 · first

California State AGAug 12 · first

Massachusetts State AGAug 12 · first

Washington State AGAug 12 · first

HHS OCRAug 12 · first

Montana State AGAug 12 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/Valley-Anesthesiology-Consultants.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 12, 2016
Raw hash: 1f5e1ee1bdc255b73c2ab17d67bdd3a42b12e81de3f43fdf2f0379c6ffa8b704

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityValley Anesthesiology Consultants, Inc.

Victim entityValley Anesthesiology Consultants, Inc.

Incidentdiscovered Jun 13, 2016

Stated responseHired a leading forensics firm to assist us

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov