HackingHealthcareHealthcareStolen CredentialsCapture App DataCustomer Data InvolvedData ExfiltratedPIIPHIIDENTITY_BASICIDENTITY_GOVERNMENTHEALTH_BASICMediumContained
Orchard Medical Consulting
bd_87bc5e0a982a7c95 · schema v1 · pii pii-v1
Full breach record for Orchard Medical Consulting →Orchard Medical Consulting, a nurse case management services provider for workers' compensation claims, discovered on January 30, 2020 that an unauthorized individual potentially gained access to a single employee's email account. Exposed data may include names, dates of birth, Social Security numbers (limited cases), diagnoses, treatment plans, and health history. The company implemented MFA, forced password resets, and offered one year of free credit monitoring to affected individuals.
This filing is one of 3 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (2) · sorted by filing gap
- bd_51b86a0c0572de64Montana State AGfiled 2020-05-05Candidate
- bd_1b27f272c568e797California State AGfiled 2020-05-28(23d gap)Verified
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-189742
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- May 5, 2020
- Raw hash
- f8139f4a922e5aa61331fba904238dc5169ceea7464bacb68a9947dc4960891e
Reporting entity
- Name
- Orchard Medical Consultingnorm: orchard medical consulting
Victim entity
- Name
- Orchard Medical Consultingnorm: orchard medical consulting
- Industry
- Healthcarellm
Incident
- Discovered
- Jan 30, 2020
- Materiality determined
- —
- Notification sent
- —
- Affected individuals
- Not disclosed
- Data types
- PIIPHIIDENTITY_BASICIDENTITY_GOVERNMENTHEALTH_BASIC
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1078 Valid AccountsT1114 Email Collection
- Threat actor
- External
- Regulator citations
- Reported incident to appropriate government regulators
- Initial access
- valid_credentials
Compliance
- Time to disclose
- 14 weeks(96 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.