Social EngineeringHealthcareHealthcarePhishingStolen CredentialsData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDHealth (basic)PHIMediumContained

Southern Orthopaedic Surgeons

bd_7819dace61f54b29 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Oct 20, 2020

Filed

Aug 9, 2021

To disclose

42 weeks

Affected

1state residents only

Confidence

66%

Full breach record for Southern Orthopaedic Surgeons →2 incidents on file

Southern Orthopaedic Surgeons notified patients that an employee's email account was compromised on October 20, 2020, potentially exposing PHI, SSNs, and driver's license numbers. Forensic review confirmed on June 11, 2021. The company engaged forensic experts and implemented new security policies.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 42 weeks / 293 days

Oct 20, 2020

Discovered

Aug 9, 2021

Filed

vs. sector median

+31 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1 affectedView incident

Name: Southern Orthopaedic Surgeons
norm: southern orthopaedic surgeons

Name: Southern Orthopaedic Surgeons
norm: southern orthopaedic surgeons
Industry: Healthcarellm

Discovered: Oct 20, 2020
Materiality determined: —
Notification sent: —
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government IDHealth (basic)PHI
Data elements: Social Security numberDate of birthMedical information
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: External
Initial access: phishing_link

During the incident: Engaged independent forensic experts and data review team
Implemented policies prohibiting employees from emailing patient information
Updating the firewall protections to include 24-hour monitoring
Requiring regular password resets
Changes made: Implemented policies prohibiting employees from emailing patient information
Updating the firewall protections to include 24-hour monitoring
Requiring regular password resets
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 42 weeks(293 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/notificationLetter-31.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 9, 2021
Raw hash: 46962375f311e8958c138c4f8678b2e9cf7a7daf5adc21c913ec35a36e493c12

Reporting entitySouthern Orthopaedic Surgeons

Victim entitySouthern Orthopaedic Surgeons

Incidentdiscovered Oct 20, 2020

Stated responseEngaged independent forensic experts and data review team

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov