HackingSupply Chain (3P Vendor)Customer Data InvolvedIDENTITY_BASICIDENTITY_GOVERNMENTHEALTH_BASICFINANCIAL_ACCOUNTMediumContained
Concord Orthopaedics
bd_6b0825db7ff9961a · schema v1 · pii pii-v1
Full breach record for Concord Orthopaedics →Concord Orthopaedics notified patients that an unauthorized actor accessed a third-party patient registration software on November 21, 2024. Potentially impacted data includes names, DOBs, SSNs, appointment info, health insurance details, and driver's license images. Concord engaged forensic specialists, reset passwords, notified law enforcement, and offered 12 months of credit monitoring.
Leak gap clock⏱ Leak >90d18 weeks discovery → filing
This filing is one of 4 about the same incident.View merged incident
A leak claim by everest about this victim predates this filing by 120 days.View originating leak claim
Linked disclosures
Why this link?Ransomware claims (1)
- bd_f4d08a489d0ae245Leak Siteeverestfiled 2024-11-24(120d gap)Verified
Regulatory filings (2) · sorted by filing gap
- bd_1645c6a6f8462615HHS OCRfiled 2025-03-25Verified
- bd_34117cf59d4cb285Indiana State AGfiled 2025-03-25Verified
Source provenance
- Source URL
- https://mm.nh.gov/files/uploads/doj/remote-docs/concord-orthopaedics-20250325.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Mar 25, 2025
- Raw hash
- 4c7c9158d6bf658b6190d5a897f17ab850611a9b61a33beea33d1cf073bb8936
Reporting entity
- Name
- Concord Orthopaedicsnorm: concord orthopaedics
- Domain
- concordortho.com
Victim entity
- Name
- Concord Orthopaedicsnorm: concord orthopaedics
- Domain
- concordortho.com
Incident
- Discovered
- Nov 21, 2024
- Materiality determined
- —
- Notification sent
- Mar 25, 2025
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENTHEALTH_BASICFINANCIAL_ACCOUNT
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1195 Supply Chain Compromise
- Threat actor
- External
- Regulator citations
- Notified federal law enforcement
- Initial access
- supply_chain
Compliance
- Time to disclose
- 18 weeks(124 days from discovery to filing)
- Compliance flags
- Leak >90d
- Discovery-date grounding
- letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.