MisuseHealthcareProfessional ServicesHealthcareKnowledge AbuseEmployee Data InvolvedCustomer Data InvolvedIdentity (basic)Government IDMediumContained

Advanced Data Processing

bd_6f310fd6d0967ea0 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Oct 1, 2012

Filed

Nov 28, 2012

To disclose

8 weeks

Affected

2state residents only

Linked

4 filings

Confidence

67%

Full breach record for Advanced Data Processing →

Advanced Data Processing, Inc. notified the NH AG of an insider threat incident where an employee accessed patient account information (names, SSNs, DOBs) to file false tax returns. Discovered Oct 1, 2012. 2 NH residents affected. Employee terminated. Notices sent Nov 29, 2012.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 8 weeks / 58 days

Oct 1, 2012

Discovered

Nov 28, 2012

Filed

vs. sector median

3 wks faster

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

California State AGbd_be9c80dd6dbf9a3c2012-11-28Verified
HHS OCRbd_b703d3e7c429a63f2012-11-29 · +1dVerified
Massachusetts State AGbd_c8eff5dfdde7712d2012-11-30 · +2dVerified

Name: Advanced Data Processing
norm: advanced data processing

Name: Advanced Data Processing
norm: advanced data processing
Industry: HealthcarellmProfessional Servicesllm

Discovered: Oct 1, 2012
Materiality determined: —
Notification sent: Nov 29, 2012
Affected individuals: 2state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security numberDate of birth
Attack vector: Insider
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: InternalFinancial
Regulator citations: Notified the Secretary of Health and Human ServicesCooperated with federal and local law enforcement agencies
Initial access: insider_action

During the incident: Terminated the employee
Cooperated fully with federal and local law enforcement agencies
Conducted its own investigation and risk assessment using internal resources and outside experts
Engaged an outside consulting firm, ID Experts, Inc., to assist the Company with assessing the risks associated with the present incident
Made its employees aware of this incident and the consequences to the individual involved
Reminded its employees of the importance of maintaining at all times the security and confidentiality of individual records
Sent notice to affected individuals by regular mail
Provided notice to the Secretary of Health and Human Services
Provided notice to the three major national credit bureaus
Offered a complimentary one year membership of Experian’s ProtectMyID Alert
Changes made: Making its employees aware of this incident and the consequences to the individual involved
Reminding its employees of the importance of maintaining at all times the security and confidentiality of individual records
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(58 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

California State AGNov 28 · first

New Hampshire State AGNov 28 · first · this page

HHS OCR+1d

Massachusetts State AG+2d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/advanced-data-processing-20121128.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 28, 2012
Raw hash: 9640c84e2f283373ec7eb6bec9a03aaa0ad9988bcf8c57143f1d802bd5124122

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityAdvanced Data Processing

Victim entityAdvanced Data Processing

Incidentdiscovered Oct 1, 2012

Stated responseTerminated the employee

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov