HackingHealthcareHealthcareData ExfiltratedDelayed DiscoveryIdentity (basic)Government IDHealth (basic)MediumContained

Texas Retina Associates

bd_7ecb1bcdef9afa2d · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 27, 2024

Filed

Jul 12, 2024

To disclose

15 weeks

Affected

Not disclosed

Linked

6 filings

Confidence

66%

Full breach record for Texas Retina Associates →

Texas Retina Associates notified consumers of a data breach where an unauthorized actor accessed systems starting Oct 8, 2023. The incident was discovered on March 27, 2024. Affected data included names and government IDs (SSN/DOB). The company engaged forensic investigators and offered credit monitoring.

J jump to incidentP pin to compareR raw source

Vermont clock✗ VT AG >45 bday15 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 171 days

discovery → filing · 15 weeks / 107 days

Oct 8, 2023

Begins

Mar 27, 2024

Discovered

Jul 12, 2024

Filed

vs. sector median

+4 wks slower

This filing is one of 6 about the same incident.View merged incident

A leak claim by bianlian about this victim predates this filing by 80 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (2)

Leak Sitebianlianbd_cc1278bb549adbbc2024-05-27 · +46dVerified by operator
Leak Sitebianlianbd_7206089cdd8d5f6e2024-04-22 · +80dVerified by operator

Regulatory filings (3) · sorted by filing gap

Massachusetts State AGbd_1108b3587182e0a12024-07-13 · +1dVerified by operator
New Hampshire State AGbd_f2dc58856b9c2fe82024-07-16 · +4dVerified by operator
HHS OCRbd_6301297bf6f0a0382024-06-21 · +21dVerified

Name: Texas Retina Associates
norm: texas retina associates
Domain: texasretina.com

Name: Texas Retina Associates
norm: texas retina associates
Domain: texasretina.com
Industry: Healthcarellm

Discovered: Mar 27, 2024
Breach occurred: Oct 8, 2023
Undetected for: 171 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 12, 2024
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDHealth (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1119 Automated Collection
Threat actor: External
Initial access: exploit_public_facing

During the incident: Took steps to contain the threat and secure our systems
Launched an investigation in consultation with outside cybersecurity professionals
Completed extensive forensic investigation and manual document review
Offered complimentary credit monitoring membership
Changes made: Continually evaluate and modify practices and internal controls to enhance the security and privacy of personal information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 15 weeks(107 days from discovery to filing)
Compliance flags: VT AG >45 bdayLeak >30d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

HHS OCRJun 21 · first

Vermont State AG+21d · this page

Massachusetts State AG+22d

New Hampshire State AG+25d

Pattern: first filing Jun 21 (TX), last Jul 16 (NH) — a 25-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ago.vermont.gov/document/2024-07-12-texas-retina-associates-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 12, 2024
Raw hash: 61ec762846b9b8256f9ab03e900f52459fe06ca4f0d155bd8bcb7db4aa7844c9

Linked disclosures

Ransomware claims (2)

Regulatory filings (3) · sorted by filing gap

Reporting entityTexas Retina Associates

Victim entityTexas Retina Associates

Incidentdiscovered Mar 27, 2024

Stated responseTook steps to contain the threat and secure our systems

ComplianceVT AG >45 bday

Extraction provenanceno artifact recorded

Source provenanceago.vermont.gov