AccidentalHealthcareHealthcareMisdeliveryCustomer Data InvolvedPHIHealth (basic)PIILowResolved

ConvenientMD Urgent Care

bd_6f78089beac24f3b · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Jan 26, 2021

To disclose

—

Affected

130state residents only

Linked

2 filings

Confidence

66%

Full breach record for ConvenientMD Urgent Care →3 incidents on file

ConvenientMD Urgent Care notified the NH Attorney General of a data security breach involving 130 New Hampshire residents. Between December 18 and 21, 2020, the company sent emails notifying individuals of available coronavirus test results. Due to a misconfiguration, all recipient email addresses were placed in the 'To' field rather than 'Bcc', exposing the email addresses of other recipients. This allowed recipients to see that others had been tested for coronavirus. No actual test results were included in the emails. ConvenientMD has corrected its email procedures.

J jump to incidentP pin to compareR raw source

Incident timeline

Dec 18, 2020

Begins

Jan 26, 2021

Filed

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_dbdf13cd8a1155272021-01-22 · +4dVerified

Name: MCLANE MIDDLETON, PROFESSIONAL ASSOCIATION
norm: mclane middleton professional

Name: ConvenientMD Urgent Care
norm: convenientmd urgent care
Industry: Healthcarellm

Discovered: —
Breach occurred: Dec 18, 2020 – Dec 21, 2020
Materiality determined: —
Notification sent: Jan 12, 2021
Affected individuals: 130state-resident count only
Data types: PHIHealth (basic)PII
Attack vector: Misconfiguration
MITRE ATT&CK: T1566.002 Spearphishing Link

During the incident: Modified its procedures for sending emails notifying individuals that information is available for them on our health care portal to ensure that the email addresses of recipients cannot be viewed by other recipients
Changes made: Modified its procedures for sending emails notifying individuals that information is available for them on our health care portal to ensure that the email addresses of recipients cannot be viewed by other recipients
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Massachusetts State AGJan 22 · first

New Hampshire State AG+4d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/convenientmd-urgent-care-20210126.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 26, 2021
Raw hash: 66f2b977fae129bdd420b5a84c23bc4a20f70ac1de225464e1d430e2ba0e95fd

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityMCLANE MIDDLETON, PROFESSIONAL ASSOCIATION

Victim entityConvenientMD Urgent Care

IncidentMisconfiguration

Stated responseModified its procedures for sending emails notifying individuals that information is available for them on our health care portal to ensure that the email addresses of recipients cannot be viewed by other recipients

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov