HackingHealthcareProfessional ServicesHealthcareStolen CredentialsTargetedIdentity (basic)Financial accountFinancial credentialsLowContained

THE MASSACHUSETTS MEDICAL SOCIETY

bd_6afeeac98ff20369 · schema v1 · pii pii-v1

Severity

Low

Discovered

Oct 11, 2024

Filed

Dec 26, 2024

To disclose

11 weeks

Affected

Not disclosed

Linked

5 filings

Confidence

65%

Full breach record for THE MASSACHUSETTS MEDICAL SOCIETY →

Massachusetts Medical Society notified consumers of a data breach involving unauthorized code installed on its e-commerce checkout page (nejm.org) between October 3 and 11, 2024. The code captured payment card details, names, addresses, and emails. The Society removed the code and enhanced safeguards. No specific count of affected individuals was provided in the filing.

J jump to incidentP pin to compareR raw source

Vermont clock✗ VT AG >45 bday11 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 8 days

discovery → filing · 11 weeks / 76 days

Oct 3, 2024

Begins

Oct 11, 2024

Discovered

Dec 26, 2024

Filed

vs. sector median

+2 wks slower

This filing is one of 5 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Indiana State AGbd_7887a2f3ee5587b42024-12-26Verified
New Hampshire State AGbd_c0cc85ac9e9879d62024-12-26Verified
Maine State AGbd_c2958815b180d7882024-12-26Candidate
Massachusetts State AGbd_e131f8680ea04c372024-12-26Verified

Name: THE MASSACHUSETTS MEDICAL SOCIETY
norm: the massachusetts medical society
Domain: nejm.org

Name: THE MASSACHUSETTS MEDICAL SOCIETY
norm: the massachusetts medical society
Domain: nejm.org
Industry: HealthcarellmProfessional Servicesllm

Discovered: Oct 11, 2024
Breach occurred: Oct 3, 2024 – Oct 11, 2024
Undetected for: 8 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 26, 2024
Affected individuals: Not disclosed
Data types: Identity (basic)Financial accountFinancial credentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1056 Input Capture
Threat actor: ExternalFinancial
Initial access: exploit_public_facing

During the incident: Launched an investigation
Removed the unauthorized code
Enhanced technical safeguards
Changes made: Enhanced technical safeguards to help prevent a similar incident
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 11 weeks(76 days from discovery to filing)
Compliance flags: VT AG >45 bday
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Indiana State AGDec 26 · first

New Hampshire State AGDec 26 · first

Maine State AGDec 26 · first

Massachusetts State AGDec 26 · first

Vermont State AGDec 26 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ago.vermont.gov/document/2024-12-26-massachusetts-medical-society-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 26, 2024
Raw hash: f57c422bd151a240987843a0666add2910720475fc25e09334c093d4864b428d

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityTHE MASSACHUSETTS MEDICAL SOCIETY

Victim entityTHE MASSACHUSETTS MEDICAL SOCIETY

Incidentdiscovered Oct 11, 2024

Stated responseLaunched an investigation

ComplianceVT AG >45 bday

Extraction provenanceno artifact recorded

Source provenanceago.vermont.gov