HackingHealthcareHealthcareStolen CredentialsSupply Chain (3P Vendor)Customer Data InvolvedEmployee Data InvolvedIdentity (basic)Health (basic)Financial accountGovernment IDMediumContained

Surgery Center of Mid Florida

bd_87b180e20c419bd6 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 21, 2024

Filed

Jul 31, 2024

To disclose

23 weeks

Affected

6state residents only

Linked

4 filings

Confidence

66%

Full breach record for Surgery Center of Mid Florida →

Surgery Center of Mid Florida notified patients of a February 21, 2024 network encryption event. Unauthorized users accessed the network via a hacked IT vendor. Data potentially exposed included demographics, PHI, insurance info, and SSNs. No evidence of misuse found. SCOMF engaged forensic experts, changed vendors, enhanced firewalls, and migrated to cloud EHR.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 23 weeks / 161 days

Feb 21, 2024

Begins

Feb 21, 2024

Discovered

Jul 31, 2024

Filed

vs. sector median

+12 wks slower

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Massachusetts State AGbd_6ee4d873495542bb2024-08-01 · +1dVerified
HHS OCRbd_94a0f71dbd6239e32024-07-24 · +7dVerified
Indiana State AGbd_bcb0813c79119dd52024-07-22 · +9dVerified

Name: Surgery Center of Mid Florida
norm: surgery center of mid florida

Name: Surgery Center of Mid Florida
norm: surgery center of mid florida
Industry: Healthcarellm

Discovered: Feb 21, 2024
Breach occurred: Feb 21, 2024
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 22, 2024
Affected individuals: 6state-resident count only
Data types: Identity (basic)Health (basic)Financial accountGovernment ID
Data elements: Social Security numberDate of birthMedical information
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain CompromiseT1190 Exploit Public-Facing Application
Threat actor: ExternalFinancial
Regulator citations: notifying certain federal and state regulators as required by law
Initial access: supply_chain

During the incident: Began an investigation, which involved the assistance of cybersecurity experts
Transferred our business to a different IT vendor
Implemented additional safeguards to improve data security on our web server infrastructure
Replaced and enhanced all firewalls
Transitioned all data to a secure, cloud-based electronic health record system and practice management software
Notifying certain federal and state regulators as required by law
Encourage you to monitor your account statements and credit reports
Contact IDX, the data breach and recovery services experts
Changes made: Implemented additional safeguards to improve data security on our web server infrastructure
Replaced and enhanced all firewalls
Transitioned all data to a secure, cloud-based electronic health record system and practice management software
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 23 weeks(161 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Indiana State AGJul 22 · first

HHS OCR+2d

Montana State AG+9d · this page

Massachusetts State AG+10d

Pattern: first filing Jul 22 (IN), last Aug 1 (MA) — a 10-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-Notification-Letter-846.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 31, 2024
Raw hash: e6fbf23a66f2776a44b797492b90ab7e10aa98b760dec7961298004c0ac2ccc7

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entitySurgery Center of Mid Florida

Victim entitySurgery Center of Mid Florida

Incidentdiscovered Feb 21, 2024

Stated responseBegan an investigation, which involved the assistance of cybersecurity experts

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov