MalwareHealthcareHealthcareRansomwareData EncryptedCustomer Data InvolvedSupply Chain (3P Vendor)PHIHealth (basic)Identity (basic)Government IDMediumContained

Eye Institute of Marin

bd_5d7bc3c6e61d8184 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 27, 2016

Filed

Nov 18, 2016

To disclose

16 weeks

Affected

Not disclosed

Linked

3 filings

Confidence

65%

Full breach record for Eye Institute of Marin →

Eye Institute of Marin notified patients of a ransomware attack on its electronic medical record provider, Marin Medical Practice Concepts, Inc. (MMPC), on July 26, 2016. The malware encrypted systems, and a backup failure resulted in the loss of consultation notes for visits between July 11 and July 26, 2016. No evidence indicated patient data was accessed or exfiltrated. Affected data included PHI, SSNs, and medical history. The provider secured the network and notified law enforcement.

J jump to incidentP pin to compareR raw source

California clockDiscovered Jul 27, 2016 → Notified Oct 18, 201683d ✗ CA 60-day late16 weeks discovery → filing

Incident timeline

undetected · 1 days

discovery → filing · 16 weeks / 114 days

Jul 26, 2016

Begins

Jul 27, 2016

Discovered

Nov 18, 2016

Filed

vs. sector median

+4 wks slower

This filing is one of 3 about the same incident.View merged incident

Part of Marin Medical Practice Concepts, Inc. supply-chain incident (2016) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_e56f3520967835502016-11-17 · +1dVerified
Montana State AGbd_9e2d62754731e1f32016-11-16 · +2dCandidate

Name: Eye Institute of Marin
norm: eye institute of marin

Name: Eye Institute of Marin
norm: eye institute of marin
Industry: Healthcarellm

Discovered: Jul 27, 2016
Breach occurred: Jul 26, 2016
Undetected for: 1 dayoccurrence → discovery
Materiality determined: —
Notification sent: Oct 18, 2016
Affected individuals: Not disclosed
Data types: PHIHealth (basic)Identity (basic)Government ID
Data elements: Date of birthMedical information
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for Impact
Threat actor: ExternalFinancial
Third party: via Marin Medical Practice Concepts, Inc.

During the incident: Notified law enforcement
Secured their network
Reviewed our policies and procedures
Discussed with matter extensively with our electronic medical record provider
Followed up on the steps taken by MMPC receiving confirmation that they have notified law enforcement and secured their network
Changes made: Offered complimentary refraction re-examination through December 31, 2016 for patients with lost refraction results
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 16 weeks(114 days from discovery to filing)
Compliance flags: CA 60-day late · 83d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Jul 27, 2016
→ Notified: Oct 18, 2016
83d 60 days (analyst band, pre-2026 discoveries) CA 60-day late

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Jul 27, 2016 → Notified: Oct 18, 2016	83d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Montana State AGNov 16 · first

Massachusetts State AG+1d

California State AG+2d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-64977
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 18, 2016
Raw hash: 9d7b85ba0236cdb21591c3b3ad7841ba29fc48de9efe46dafd1e08fc586abbfb

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityEye Institute of Marin

Victim entityEye Institute of Marin

Incidentdiscovered Jul 27, 2016

Stated responseNotified law enforcement

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov