Social EngineeringTechnologyHealthcareInformationPhishingStolen CredentialsData ExfiltratedTargetedCustomer Data InvolvedIdentity (basic)Government IDFinancial accountMediumContained

Aptus Health Inc

bd_5b7b30ad1602f12d · schema v1 · pii pii-v1

Severity

Medium

Discovered

Dec 13, 2018

Filed

Jan 31, 2019

To disclose

7 weeks

Affected

8state residents only

Linked

2 filings

Confidence

66%

Full breach record for Aptus Health Inc →

Aptus Health Inc. reported a business email compromise in New Hampshire. Following a phishing attack, hackers accessed a payroll manager's email account between August 17 and October 5, 2018. The account contained PII of employees and contractors, including SSNs, bank account numbers, and passport numbers. Eight NH residents were affected. Notifications were sent on January 31, 2019.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 118 days

discovery → filing · 7 weeks / 49 days

Aug 17, 2018

Begins

Dec 13, 2018

Discovered

Jan 31, 2019

Filed

vs. sector median

12 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_4ce5e55761ed0f372019-02-01 · +1dVerified

Name: NUTTER, MCCLENNEN & FISH, LLP
norm: nutter mcclennen fish

Name: Aptus Health Inc
norm: aptus health
Industry: TechnologyllmHealthcarellm

Discovered: Dec 13, 2018
Breach occurred: Aug 17, 2018 – Oct 5, 2018
Undetected for: 118 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 31, 2019
Affected individuals: 8state-resident count only
Data types: Identity (basic)Government IDFinancial account
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Regulator citations: Notified the FBI of the incident immediately after it was discoveredProvided formal notice to the New Hampshire Attorney General
Initial access: phishing_link

During the incident: Required all users to change their passwords
Began implementing multi-factor authentication for all email logins
Implemented email notifications regarding suspicious activity
Issued new laptops to certain users
Quarantined several laptops while completing malware scans and reviewing patch and event logs
Blacklisted credential harvesting IP's
Upgraded firewalls
Implemented monthly review of Office365 Cloud App Security
Enhanced email security by implementing a Sender Policy Framework (SPF), DomainKeys Identification Mail (DKIM) and Domain Message Authentication Reporting & Conformance (DMARC)
Notified the FBI of the incident immediately after it was discovered
Engaged Booz Allen Hamilton to determine the nature and scope of the breach
Changes made: Implementing additional safeguards on its web server infrastructure
Taking steps to protect personal data from theft or criminal activity in the future
Offering identity theft protection services through ID Experts to provide affected individuals with MyIDCare
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 weeks(49 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

New Hampshire State AGJan 31 · first · this page

Massachusetts State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/aptus-health-20190131.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 31, 2019
Raw hash: fa7e5be601f4116e8c0fdd8ac9583133a8c5ecc55cf2c5bf2a418581f18b131d

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityNUTTER, MCCLENNEN & FISH, LLP

Victim entityAptus Health Inc

Incidentdiscovered Dec 13, 2018

Stated responseRequired all users to change their passwords

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov