MalwareHealthcareHealthcareRansomwareRansom DemandedData ExfiltratedIdentity (basic)Government IDHealth (basic)Financial accountMediumContained

Sarrell Dental

bd_7d46dc68cb732b04 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 1, 2019

Filed

Sep 17, 2019

To disclose

11 weeks

Affected

4state residents only

Linked

3 filings

Confidence

66%

Full breach record for Sarrell Dental →

Sarrell Dental, a not-for-profit healthcare organization, notified the NH Attorney General of a ransomware incident detected in July 2019. The intrusion may have begun in Jan 2019. No evidence of data extraction was found, but personal info (names, DOB, SSNs, health insurance, treatment info) of 4 NH residents may have been accessed. Sarrell shut down networks, engaged forensic investigators, restored systems, and offered identity protection services.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 181 days

discovery → filing · 11 weeks / 78 days

Jan 1, 2019

Begins

Jul 1, 2019

Discovered

Sep 17, 2019

Filed

vs. sector median

on median

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

HHS OCRbd_279a4dc7a72f31fc2019-09-12 · +5dVerified
Massachusetts State AGbd_b5b88218a288ea752019-09-12 · +5dVerified

Name: NUTTER, MCCLENNEN & FISH, LLP
norm: nutter mcclennen fish

Name: Sarrell Dental
norm: sarrell dental
Industry: Healthcarellm

Discovered: Jul 1, 2019
Breach occurred: Jan 1, 2019 – Jul 1, 2019
Undetected for: 181 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 12, 2019
Affected individuals: 4state-resident count only
Data types: Identity (basic)Government IDHealth (basic)Financial account
Data elements: Social Security numberDate of birthMedical information
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Informing all required regulatory agencies, federal and state, including the U.S. Department of Health and Human Services

During the incident: Instituted a temporary business shutdown and network deactivation
Commenced an investigation
Working with outside counsel and third-party forensic investigators
Restored their computer systems
Updated security and virus protection for the entire Sarrell Dental network
Network and systems are now monitored with upgraded capabilities
Sending individual notifications to the potentially impacted patient population
Posting public notice on their website
Issuing the required media notices
Informing all required regulatory agencies, federal and state, including the U.S. Department of Health and Human Services
Offering all potentially affected individuals complimentary identity protection services
Changes made: Restored their computer systems
Updated security and virus protection for the entire Sarrell Dental network
Network and systems are now monitored with upgraded capabilities to ensure that their system and the information they store will remain secure
Fortify the protective measures in place throughout its network
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 11 weeks(78 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

HHS OCRSep 12 · first

Massachusetts State AGSep 12 · first

New Hampshire State AG+5d · this page

Pattern: first filing Sep 12 (AL), last Sep 17 (NH) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/sarrell-dental-20190917.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 17, 2019
Raw hash: e9f2537182d454e9768e2e700157284d5434b56c363fbeb80b26d970bcdc3a54

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityNUTTER, MCCLENNEN & FISH, LLP

Victim entitySarrell Dental

Incidentdiscovered Jul 1, 2019

Stated responseInstituted a temporary business shutdown and network deactivation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov