HackingHealthcareHealthcareStolen CredentialsCustomer Data InvolvedIdentity (basic)CredentialsHealth (basic)Financial accountLowContained

University Urology, P.C.

bd_55d095fee5cfc532 · schema v1 · pii pii-v1

Severity

Low

Discovered

Feb 1, 2023

Filed

May 1, 2023

To disclose

13 weeks

Affected

Not disclosed

Linked

2 filings

Confidence

66%

Full breach record for University Urology, P.C. →2 incidents on file

University Urology experienced a cybersecurity incident in February 2023 where an unauthorized actor accessed patient records. Compromised data included names, addresses, DOBs, credentials, and PHI. The organization engaged forensic investigators, reset passwords, and provided credit monitoring to affected individuals.

J jump to incidentP pin to compareR raw source

Vermont clock✗ VT AG >45 bday13 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

discovery → filing · 13 weeks / 89 days

Feb 1, 2023

Discovered

May 1, 2023

Filed

vs. sector median

+4 wks slower

This filing is one of 2 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

HHS OCRbd_10215682e2e3f03e2023-05-01Verified

Name: University Urology, P.C.
norm: university urology

Name: University Urology, P.C.
norm: university urology
Also named: Jed C. Kaminetsky, M.D., P.C.dba oflegal entity
University Urologydba oftrade name
Industry: Healthcarellm

Discovered: Feb 1, 2023
Materiality determined: —
Notification sent: May 1, 2023
Affected individuals: Not disclosed
Data types: Identity (basic)CredentialsHealth (basic)Financial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Initial access: valid_credentials

During the incident: Engaged a law firm specializing in cybersecurity and data privacy to investigate further
Engaged third-party cybersecurity specialists to assist in its analysis of any unauthorized activity
Performed manual review of its patient list to identify all individuals impacted
Engaged a vendor to assist with mailing notice letters to all individuals
Set up a call center
Provided credit monitoring and identity theft protection services
Changes made: Deployed SentinelOne agents for 30 days which allowed the cybersecurity firm’s security operations center (SOC) to monitor the environment 24/7 for indications of compromise and other malicious activity
Reset all passwords
Exported backup data of all critical systems
Removed all unauthorized remote access tools
Limited remote access to authorized personnel
Deleted/removed all persistence mechanisms
Banned any identified malicious files from the environment
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 13 weeks(89 days from discovery to filing)
Compliance flags: VT AG >45 bday
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

HHS OCRMay 1 · first

Vermont State AGMay 1 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ago.vermont.gov/document/2023-05-01-university-urology-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 1, 2023
Raw hash: b2178db96cad68050615f388811907398c47013ec79dcc7f106cc0825e185f4d

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityUniversity Urology, P.C.

Victim entityUniversity Urology, P.C.

Incidentdiscovered Feb 1, 2023

Stated responseEngaged a law firm specializing in cybersecurity and data privacy to investigate further

ComplianceVT AG >45 bday

Extraction provenanceno artifact recorded

Source provenanceago.vermont.gov