HackingHealthcareHealthcareStolen CredentialsData ExfiltratedIdentity (basic)Government IDFinancial accountHealth (basic)PHIHighContained

OrthoAlaska, LLC

bd_630a6272366a9e32 · schema v1 · pii pii-v1

Severity

High

Discovered

Oct 12, 2022

Filed

Oct 13, 2023

To disclose

12 months

Affected

1,529state residents only

Linked

7 filings

Confidence

67%

Full breach record for OrthoAlaska, LLC →2 incidents on file

OrthoAlaska, LLC notified Washington AG Bob Ferguson of a data security incident discovered on October 12, 2022. Unauthorized access to patient files containing PII, PHI, and financial data occurred. 1,529 Washington residents were notified on October 11, 2023. The FBI was notified, and credit monitoring services were offered.

J jump to incidentP pin to compareR raw source

Washington clock✗ WA AG >90d12 months discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

discovery → filing · 12 months / 366 days

Oct 12, 2022

Discovered

Oct 13, 2023

Filed

vs. sector median

+40 wks slower

This filing is one of 7 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

Maine State AGbd_7b82937d6cbd83072023-10-13Verified
California State AGbd_8fae6c27242b6c072023-10-13Verified
Oregon State AGbd_c52da3c2c9a6fa5a2023-10-13Verified
Massachusetts State AGbd_f0e02ecdc89f35232023-10-13Verified

Show 2 more filings ↓up to 193d gap

New Hampshire State AGbd_2243577418f9038a2023-10-12 · +1dVerified
Montana State AGbd_5184f8b3b12232a92023-04-03 · +193dCandidate

Name: OrthoAlaska, LLC
norm: orthoalaska

Name: OrthoAlaska, LLC
norm: orthoalaska
Industry: Healthcarellm

Discovered: Oct 12, 2022
Materiality determined: —
Notification sent: Oct 11, 2023
Affected individuals: 1,529state-resident count only
Data types: Identity (basic)Government IDFinancial accountHealth (basic)PHI
Data elements: Social Security numberDate of birthMedical information
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Reported the incident to the Federal Bureau of Investigation
Initial access: valid_credentials

During the incident: Retained independent cybersecurity experts to conduct a forensic investigation
Reported the incident to the Federal Bureau of Investigation
Provided individuals whose SSN was potentially affected with access to Single Bureau Credit Monitoring/Single Bureau Credit Report/Single Bureau Credit Score services at no charge
Provided individuals with proactive fraud assistance through IDX through CyberScan
Changes made: Implemented additional security measures to protect their digital environment and minimize the likelihood of future incidents
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 12 months(366 days from discovery to filing)
Compliance flags: WA AG >90d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 7 states

View merged incident ↗

Montana State AGApr 3 · first

New Hampshire State AG+192d

Maine State AG+193d

California State AG+193d

Oregon State AG+193d

Massachusetts State AG+193d

Washington State AG+193d · this page

Pattern: first filing Apr 3 (MT), last Oct 13 (WA) — a 193-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26772.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 13, 2023
Raw hash: e86616e79a6f2c4534406613d21d3ee2b3d3480d4acfbe418ecf87121ea07ac9

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityOrthoAlaska, LLC

Victim entityOrthoAlaska, LLC

Incidentdiscovered Oct 12, 2022

Stated responseRetained independent cybersecurity experts to conduct a forensic investigation

ComplianceWA AG >90d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com