HackingHealthcareHealthcareHacking OtherCustomer Data InvolvedIdentity (basic)Government IDCriticalResolved

Jefferson Surgical Clinic

bd_6b9920a9fc4f1702 · schema v1 · pii pii-v1

Severity

Critical

Discovered

Jun 5, 2021

Filed

Jan 6, 2022

To disclose

31 weeks

Affected · nationwide

174,76915 in this filing

Linked

5 filings

Confidence

50%

Full breach record for Jefferson Surgical Clinic →

Jefferson Surgical Clinic, a healthcare organization, experienced an external system breach on June 5, 2021, which was discovered the same day. The breach affected 15 Maine residents, compromising their names and Social Security numbers. In response, the clinic provided written notification to the affected individuals on January 6, 2022, and offered 12 months of credit monitoring and identity theft protection services.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Jun 5, 2021 → Filed with AG Jan 6, 2022215d ✗ ME AG >90d31 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 31 weeks / 215 days

Jun 5, 2021

Begins

Jun 5, 2021

Discovered

Jan 6, 2022

Filed

vs. sector median

+18 wks slower

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Massachusetts State AGbd_385af5d013b47f6c2022-01-06Verified
New Hampshire State AGbd_6c4d3103dee84d782022-01-06Verified
Indiana State AGbd_96a5fa0ff1a0b9b22022-01-06Verified
Montana State AGbd_ab4e14fe519daefb2022-01-06Candidate

Name: Jefferson Surgical Clinic
norm: jefferson surgical clinic

Name: Jefferson Surgical Clinic
norm: jefferson surgical clinic
Industry: Healthcarellm

Discovered: Jun 5, 2021
Breach occurred: Jun 5, 2021
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 6, 2022
Affected individuals: 174,769state + nationwide
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Unauthorized Access

Changes made: Offered 12 months of credit monitoring and identity theft protection services.
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 31 weeks(215 days from discovery to filing)
Compliance flags: ME AG >90d · 215dME resident >60d · 215d
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Jun 5, 2021
→ Filed with AG: Jan 6, 2022
215d 90 days ME AG >90d
Maine
Discovered: Jun 5, 2021
→ Notified: Jan 6, 2022
215d 60 days (analyst band; statutory cap is 30 days) ME resident >60d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Jun 5, 2021 → Filed with AG: Jan 6, 2022	215d	90 days	ME AG >90d
Maine	Discovered: Jun 5, 2021 → Notified: Jan 6, 2022	215d	60 days (analyst band; statutory cap is 30 days)	ME resident >60d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Massachusetts State AGJan 6 · first

New Hampshire State AGJan 6 · first

Indiana State AGJan 6 · first

Montana State AGJan 6 · first

Maine State AGJan 6 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/6a6a11e7-9b41-43dd-a674-e6e34fa6b22b.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 6, 2022
Raw hash: 324fd474ae2c8f9b200326098fc9b14ea68f094e0e0471347f89b87cca1e1925

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityJefferson Surgical Clinic

Victim entityJefferson Surgical Clinic

Incidentdiscovered Jun 5, 2021

Stated responseOffered 12 months of credit monitoring and identity theft protection services.

ComplianceME AG >90d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov