MalwareHealthcareHealthcareRansomwareData EncryptedTargetedPHIHealth (basic)Identity (basic)Government IDFinancial accountMediumContained

University Gastroenterology, Inc.

bd_66e4fd275fd9ad78 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 11, 2016

Filed

Sep 8, 2016

To disclose

8 weeks

Affected

15state residents only

Linked

3 filings

Confidence

67%

Full breach record for University Gastroenterology, Inc. →

University Gastroenterology (UGI) notified the NH AG of a July 11, 2016 ransomware incident affecting 15 NH residents. Unauthorized access to an acquired practice's file storage system resulted in file encryption and exposure of PHI, SSNs, and billing data. UGI engaged forensic experts, disabled accounts, and deployed anti-malware solutions.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 8 weeks / 59 days

Jul 11, 2016

Discovered

Sep 8, 2016

Filed

vs. sector median

1 wks faster

This filing is one of 3 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_1f942f7275cec9bc2016-09-08Verified
HHS OCRbd_28d18e44c46f69822016-09-08Verified

Name: Wilson, Elser, Moskowitz, Edelman & Dicker LLP
norm: wilson elser moskowitz edelman dicker
Domain: wilsonelser.com

Name: University Gastroenterology, Inc.
norm: university gastroenterology
Industry: Healthcarellm

Discovered: Jul 11, 2016
Materiality determined: —
Notification sent: Sep 8, 2016
Affected individuals: 15state-resident count only
Data types: PHIHealth (basic)Identity (basic)Government IDFinancial account
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Office of the Attorney General
Initial access: valid_credentials

During the incident: Engaged outside security experts to conduct an investigation
Disabled all user accounts
Conducted a full virus scan
Took down all remote access to its system
Took down the entire system until a forensic analysis could be commenced
Notified credit reporting agencies
Changes made: Deploying a second-level anti-malware solution to every computer and server within the system
Disabling inactive user accounts
Removing the affected servers
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(59 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Massachusetts State AGSep 8 · first

HHS OCRSep 8 · first

New Hampshire State AGSep 8 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/university-gastroenterology-20160908.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 8, 2016
Raw hash: 514ef990161ad6c64a3e5653a09a419a6acda830e9f7342d6284197c1f106e41

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityWilson, Elser, Moskowitz, Edelman & Dicker LLP

Victim entityUniversity Gastroenterology, Inc.

Incidentdiscovered Jul 11, 2016

Stated responseEngaged outside security experts to conduct an investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov