PhysicalHealthcareHealthcareTheftCustomer Data InvolvedPHIIdentity (basic)Government IDHealth (basic)MediumActive

Steinborn, Dr. Catherine DDS

bd_5bdb4d66091e175b · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 5, 2015

Filed

Feb 19, 2015

To disclose

6 weeks

Affected

4state residents only

Linked

4 filings

Confidence

66%

Dr. Cathrine Steinborn, DDS reported the theft of a server containing patient records during a burglary on January 5, 2015. The stolen server contained personal and protected health information, including names, addresses, dates of birth, Social Security numbers, and health history for approximately 4 New Hampshire residents. The office notified affected individuals starting January 9, 2015, and offered one year of credit monitoring. The investigation is ongoing.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 6 weeks / 45 days

Jan 5, 2015

Begins

Jan 5, 2015

Discovered

Feb 19, 2015

Filed

vs. sector median

6 wks faster

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

California State AGbd_7f9d9d7a02d8e7142015-02-20 · +1dCandidate
Massachusetts State AGbd_906f024c904470552015-02-26 · +7dVerified
HHS OCRbd_6a9d74d991d6ec5f2015-02-27 · +8dVerified

Name: Steinborn, Dr. Catherine DDS
norm: steinborn dr catherine dds

Name: Steinborn, Dr. Catherine DDS
norm: steinborn dr catherine dds
Industry: Healthcarellm

Discovered: Jan 5, 2015
Breach occurred: Jan 5, 2015
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 9, 2015
Affected individuals: 4state-resident count only
Data types: PHIIdentity (basic)Government IDHealth (basic)
Data elements: Social Security numberDate of birth
Attack vector: Unknown
MITRE ATT&CK: T1052 Exfiltration Over Physical Medium
Threat actor: External
Regulator citations: Providing notice of this incident to certain federal and other state regulators

During the incident: Reported the burglary to the Santa Clara Police Department
Increased physical security and surveillance of the premises
Encrypted patient and responsible party information
Enhanced physical security of the server on which this information is stored
Mailed written notice to the last known address of each record holder
Provided additional written notice to affected individuals including information on how to protect against identity theft and fraud
Offered one free year of credit monitoring and identity restoration services
Providing notice of this incident to certain federal and other state regulators
Changes made: Increased physical security and surveillance of the premises
Encrypted patient and responsible party information
Enhanced physical security of the server on which this information is stored
Having the new server encrypted
Implementing robust physical and IT security going forward
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(45 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 3 states

View merged incident ↗

New Hampshire State AGFeb 19 · first · this page

California State AG+1d

Massachusetts State AG+7d

HHS OCR+8d

Pattern: first filing Feb 19 (NH), last Feb 27 (CA) — a 8-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/steinborn-catherine-20150219.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 19, 2015
Raw hash: f3e06c3b767b080c0a44941e49f305fcd43c4567b886a27bc5368a2048e5028b

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entitySteinborn, Dr. Catherine DDS

Victim entitySteinborn, Dr. Catherine DDS

Incidentdiscovered Jan 5, 2015

Stated responseReported the burglary to the Santa Clara Police Department

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov