AccidentalHealthcareRetail & ConsumerHealthcareMisconfigurationCustomer Data InvolvedSupply Chain (3P Vendor)Identity (basic)Financial accountLowContained

Rx Valet LLC

bd_884ea13ce10e2564 · schema v1 · pii pii-v1

Severity

Low

Discovered

Mar 1, 2018

Filed

May 4, 2018

To disclose

9 weeks

Affected

101

Confidence

65%

Full breach record for Rx Valet LLC →

Rx Valet LLC notified NH AG of a data breach caused by a third-party vendor's server misconfiguration in late 2017. Approximately 101 customers' personal info (name, address, email, obscured credit card last 4 digits) was accessed. Incident discovered in March 2018. 2 NH residents affected. Remediation included rectifying server config and implementing additional security measures.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 120 days

discovery → filing · 9 weeks / 64 days

Nov 1, 2017

Begins

Mar 1, 2018

Discovered

May 4, 2018

Filed

vs. sector median

2 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed101 affectedView incident

Name: Taylor English Duma LLP
norm: taylor english duma

Name: Rx Valet LLC
norm: rx valet
Domain: myrxvalet.com
Industry: HealthcarellmRetail & Consumerllm

Discovered: Mar 1, 2018
Breach occurred: Nov 1, 2017 – Feb 28, 2018
Undetected for: 120 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 4, 2018
Affected individuals: 101state + nationwide
Data types: Identity (basic)Financial account
Attack vector: Misconfiguration
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Regulator citations: Notified NH Department of Justice pursuant to New Hampshire Revised Statutes Chapter 359-C, § 359-C:20

During the incident: Used outside forensic and legal experts to assist in our investigation
Notified customers via the home page of the Company website
Caused the third-party service provider to rectify the server error
Changes made: Implemented additional security measures designed to prevent a recurrence of such an issue
Rectified server configuration handled by third party service provider
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(64 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/rx-valet-20180504.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 4, 2018
Raw hash: 6744604e26449f2d88c7603bcb7bde29ac13cdef03bc69120a0190c5f2856a0d

Reporting entityTaylor English Duma LLP

Victim entityRx Valet LLC

Incidentdiscovered Mar 1, 2018

Stated responseUsed outside forensic and legal experts to assist in our investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov