MalwareHealthcareHealthcareRansomwareData EncryptedTargetedIdentity (basic)Government IDFinancial accountPHIHealth (basic)MediumContained

Westminster Ingleside King Farm Presbyterian Retirement Communities, Inc.

bd_6810cf3eae2762a9 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 21, 2017

Filed

Jan 19, 2018

To disclose

8 weeks

Affected

10state residents only

Linked

4 filings

Confidence

67%

Full breach record for Westminster Ingleside King Farm Presbyterian Retirement Communities, Inc. →

Westminster Ingleside King Farm Presbyterian Retirement Communities, Inc. notified the NH AG of a malware attack discovered on Nov 21, 2017. 10 NH residents affected. Data at risk included PII, SSN, PHI, and financial info. Remediation included MFA, firewall upgrades, and 12 months of Kroll credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 8 weeks / 59 days

Nov 21, 2017

Discovered

Jan 19, 2018

Filed

vs. sector median

1 wks faster

This filing is one of 4 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Montana State AGbd_a2a0fdddd4e3a1182018-01-19Verified
Massachusetts State AGbd_b6656097e65cbfdc2018-01-19Verified
HHS OCRbd_ca864a1b1ca609d32018-01-19Verified

Name: Wilson, Elser, Moskowitz, Edelman & Dicker LLP
norm: wilson elser moskowitz edelman dicker
Domain: wilsonelser.com

Name: Westminster Ingleside King Farm Presbyterian Retirement Communities, Inc.
norm: westminster ingleside king farm presbyterian retirement communities
Industry: Healthcarellm

Discovered: Nov 21, 2017
Materiality determined: —
Notification sent: Jan 19, 2018
Affected individuals: 10state-resident count only
Data types: Identity (basic)Government IDFinancial accountPHIHealth (basic)
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Office of the Attorney General

During the incident: Launched a software program to assist in finding and removing the malware from its system
Engaged independent computer forensics experts to determine how the incident occurred and if information had been accessed by an unauthorized third party
Provided potentially impacted individuals with identity theft restoration and credit monitoring services for 12 months at no cost to the individual, through Kroll
Notice is also being provided to the credit reporting agencies
Changes made: Upgrading its firewall, antivirus and malware security
Requiring all new user credentials/passwords
Adopting dual-factor authentication
Providing additional staff training on identifying unauthorized access
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(59 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Montana State AGJan 19 · first

Massachusetts State AGJan 19 · first

HHS OCRJan 19 · first

New Hampshire State AGJan 19 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/westminster-ingleside-20180119.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 19, 2018
Raw hash: cb0f0086064f043f4428eedccf159bae0bf86608200c6fab04587eae542f3c57

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityWilson, Elser, Moskowitz, Edelman & Dicker LLP

Victim entityWestminster Ingleside King Farm Presbyterian Retirement Communities, Inc.

Incidentdiscovered Nov 21, 2017

Stated responseLaunched a software program to assist in finding and removing the malware from its system

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov