HackingHealthcareHealthcareCustomer Data InvolvedDelayed DiscoveryHealth (basic)Identity (basic)Government IDPHIMediumContained

Dermatology Associates

bd_808c94933cf678ad · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 4, 2025

Filed

Mar 4, 2026

To disclose

30 weeks

Affected

5state residents only

Linked

4 records

Confidence

64%

Full breach record for Dermatology Associates →4 incidents on file

Dermatology Associates notified the Massachusetts Attorney General of an unauthorized access incident. The organization became aware of suspicious activity on August 4, 2025. An investigation determined that an unauthorized actor accessed systems between June 4, 2025, and August 5, 2025. The incident potentially involved protected health information (PHI), including names, addresses, dates of birth, and Social Security numbers. The organization engaged third-party cybersecurity specialists, notified affected individuals via website and media, and is offering 24 months of credit monitoring. The investigation is contained.

J jump to incidentP pin to compareR raw source

Massachusetts clock✗ MA AG >90d30 weeks discovery → filing

Incident timeline

undetected · 61 days

discovery → filing · 30 weeks / 212 days

Jun 4, 2025

Begins

Aug 4, 2025

Discovered

Mar 4, 2026

Filed

vs. sector median

+21 wks slower

This filing is one of 4 records about the same incident.View merged incident

A leak claim by anubis about this victim was first seen 118 days before this filing.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Siteanubisbd_07b8e25f7f3b2d112025-11-06 · +117dCandidate

Regulatory filings (2) · sorted by filing gap

New Hampshire State AGbd_b8e34d45fafe61dd2026-03-04Verified by operator
HHS OCRbd_2d22edc295ce74862025-10-03 · +152dVerified

Name: Dermatology Associates
norm: dermatology associates
Domain: totalskinhealth.com

Name: Dermatology Associates
norm: dermatology associates
Domain: totalskinhealth.com
Industry: Healthcarellm

Discovered: Aug 4, 2025
Breach occurred: Jun 4, 2025 – Aug 5, 2025
Undetected for: 61 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 4, 2026
Affected individuals: 5state-resident count only
Data types: Health (basic)Identity (basic)Government IDPHI
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Reported to federal law enforcementReported to the U.S. Department of Health and Human Services

During the incident: Launched an investigation with the assistance of third-party cybersecurity specialists
Notified potentially affected individuals via website and media notice
Performed a time-intensive third-party review of the impacted files
Undertook a detailed internal review of records to identify contact information
Reported the event to appropriate governmental agencies, including federal law enforcement and the U.S. Department of Health and Human Services
Offering twenty-four (24) months of Single Bureau Credit Monitoring/Single Bureau Credit Report/Single Bureau Credit Score services through TransUnion at no cost
Changes made: Reviewing policies, procedures, and processes to reduce the likelihood of a similar future event
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 30 weeks(212 days from discovery to filing)
Compliance flags: MA AG >90dLeak >90d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

HHS OCROct 3 · first

New Hampshire State AG+152d

Massachusetts State AG+152d · this page

Pattern: first filing Oct 3 (KY), last Mar 4 (MA) — a 152-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.mass.gov/doc/2026-322-dermatology-associates/download
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 4, 2026
Raw hash: cbda249f770d127793e84d5dd8c8b5f97e37a484316901e4f266ccdb5982af89

Linked disclosures

Ransomware claims (1)

Regulatory filings (2) · sorted by filing gap

Reporting entityDermatology Associates

Victim entityDermatology Associates

Incidentdiscovered Aug 4, 2025

Stated responseLaunched an investigation with the assistance of third-party cybersecurity specialists

ComplianceMA AG >90d

Extraction provenanceno artifact recorded

Source provenancewww.mass.gov