MalwareHealthcareHealthcareRansomwareData EncryptedTargetedIdentity (basic)Government IDFinancial accountHealth (basic)PHIMediumContained

Plastic Surgery Associates of South Dakota, Ltd.

bd_831e5c6cca2fa1ff · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 12, 2017

Filed

Jun 27, 2017

To disclose

19 weeks

Affected

8state residents only

Confidence

64%

Plastic Surgery Associates of South Dakota, Ltd. notified patients of a ransomware incident discovered on February 12, 2017. While unauthorized access was ruled out for most records, the company could not rule out access to a limited number of patient records containing PHI, SSNs, and financial data. The company engaged forensic experts, reported to HHS, and offered one year of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 19 weeks / 135 days

Feb 12, 2017

Begins

Feb 12, 2017

Discovered

Jun 27, 2017

Filed

vs. sector median

+7 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed8 affectedView incident

Name: Plastic Surgery Associates of South Dakota, Ltd.
norm: plastic surgery associates

Name: Plastic Surgery Associates of South Dakota, Ltd.
norm: plastic surgery associates
Industry: Healthcarellm

Discovered: Feb 12, 2017
Breach occurred: Feb 12, 2017
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 26, 2017
Affected individuals: 8state-resident count only
Data types: Identity (basic)Government IDFinancial accountHealth (basic)PHI
Data elements: Social Security numberDate of birthMedical information
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for Impact
Threat actor: ExternalFinancial
Regulator citations: Reporting this incident to the U.S. Department of Health and Human Services (HHS)

During the incident: Began efforts to remove the ransomware
Hired third-party experts to determine what data, if any was subject to unauthorized access
Reporting this incident to the U.S. Department of Health and Human Services (HHS)
Partnered with Equifax to provide its Credit Watch Silver credit monitoring and identity theft protection product for one year at no charge
Changes made: Working to implement additional safeguards and security measures to enhance the privacy and security of information on our systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 19 weeks(135 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/Plastic-Surgery-Associates.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 27, 2017
Raw hash: 489e0fabd67bfce6cee0aa1dadd960cfe429daedc45eb366ca723b04a48df6ab

Reporting entityPlastic Surgery Associates of South Dakota, Ltd.

Victim entityPlastic Surgery Associates of South Dakota, Ltd.

Incidentdiscovered Feb 12, 2017

Stated responseBegan efforts to remove the ransomware

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov