HackingHealthcareHealthcareVulnerability ExploitData ExfiltratedCustomer Data InvolvedPHIIdentity (basic)Government IDHealth (basic)Financial accountMediumResolved

Medical Review Institute of America

bd_6bdf6c2db4de4bec · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 9, 2021

Filed

Jan 10, 2022

To disclose

9 weeks

Affected

346state residents only

Linked

28 filings

Confidence

66%

Full breach record for Medical Review Institute of America →

Medical Review Institute of America (MRIoA) notified the NH Attorney General of a cyber incident where an unauthorized individual gained access to its network via a SonicWall vulnerability on November 2, 2021. MRIoA discovered the incident on November 9, 2021. The breach affected 346 New Hampshire residents, exposing demographic information (including SSNs), clinical information (PHI), and financial information (insurance details). MRIoA confirmed deletion of the obtained data and implemented remediation measures including new servers, enhanced authentication, and credit monitoring for affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 7 days

discovery → filing · 9 weeks / 62 days

Nov 2, 2021

Begins

Nov 9, 2021

Discovered

Jan 10, 2022

Filed

vs. sector median

4 wks faster

This filing is one of 28 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

New Hampshire State AGbd_1684aaa6efb0e0ed2022-01-21 · +11dVerified
Maine State AGbd_3d174f7229de2ff32022-02-03 · +24dVerified
California State AGbd_ae43d458dae1f29d2022-02-03 · +24dVerified
New Hampshire State AGbd_838ab18b44e7e3882022-03-14 · +63dVerified by operator

Show 6 more filings ↓up to 266d gap

California State AGbd_0d6158d9c6700f782022-05-10 · +120dVerified by operator
California State AGbd_99bd469703a810be2022-07-13 · +184dVerified by operator
Maine State AGbd_b7d4763ef84ebad12022-07-13 · +184dVerified by operator
New Hampshire State AGbd_0419f8046cf11a832022-07-16 · +187dVerified by operator
New Hampshire State AGbd_f9c8e0a19de550ed2022-07-16 · +187dVerified by operator
California State AGbd_9e29b8e3584b22802022-10-03 · +266dVerified by operator

Showing first 10 of 27 linked disclosures.

Name: Medical Review Institute of America
norm: medical review institute of america
Domain: mrioa.com

Name: Medical Review Institute of America
norm: medical review institute of america
Domain: mrioa.com
Industry: Healthcarellm

Discovered: Nov 9, 2021
Breach occurred: Nov 2, 2021
Undetected for: 7 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 7, 2022
Affected individuals: 346state-resident count only
Data types: PHIIdentity (basic)Government IDHealth (basic)Financial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Regulator citations: Notified the New Hampshire Attorney GeneralContacted the FBIProvided notice to applicable government regulators and other Attorneys General
Initial access: exploit_public_facing

During the incident: Hired third-party forensic experts to conduct a thorough investigation
Contacted the FBI to seek assistance with the incident
Took immediate steps to stop the threat and understand the full scope
Retrieved and subsequently confirmed the deletion of the obtained information
Provided the notice to the three nationwide consumer reporting agencies, applicable government regulators, officials, and other Attorneys General
Changes made: Constant monitoring of its systems with advanced threat hunting and detection software
Adding additional authentication protections when attempting to access the systems
New servers built from the ground up to ensure all threat remnants were removed
Working with external third-party cybersecurity experts to assist in their security efforts
Deploying a hardened and new backup environment
Enhancing its employee cybersecurity training
Reviewing, revising, and amending its existing cybersecurity policies as necessary
Providing free access to credit monitoring services for one year, through Kroll
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(62 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 3 states

View merged incident ↗

New Hampshire State AGJan 10 · first · this page

New Hampshire State AG+11d

Maine State AG+24d

California State AG+24d

New Hampshire State AG+63d

California State AG+120d

California State AG+184d

Maine State AG+184d

New Hampshire State AG+187d

California State AG+266d

Pattern: first filing Jan 10 (NH), last Oct 3 (CA) — a 266-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Cascade drawn from the first 10 linked disclosures of 27 — the full spread may be wider.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/medical-review-institute-america-20220110.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 10, 2022
Raw hash: 1707f4e99ae3ab40409a5e67651f6e7c8dcc9ddf7d3861c42a817d36bf0065d0

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entityMedical Review Institute of America

Victim entityMedical Review Institute of America

Incidentdiscovered Nov 9, 2021

Stated responseHired third-party forensic experts to conduct a thorough investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov