Social EngineeringHealthcareHealthcarePhishingStolen CredentialsData ExfiltratedCustomer Data InvolvedPIIPHIIdentity (basic)MediumContained

The Mount Kisco Surgery Center LLC

bd_8af3e03d49b06830 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 3, 2023

Filed

Jun 26, 2024

To disclose

34 weeks

Affected

21,073

Linked

5 filings

Confidence

65%

Full breach record for The Mount Kisco Surgery Center LLC →

The Ambulatory Surgery Center of Westchester (ASCW) notified 21,073 individuals of a data breach where an employee's email account was compromised via phishing between Oct 23 and Nov 3, 2023. The incident exposed names and protected health information. ASCW engaged forensic investigators, enhanced email security, and offered 12 months of identity protection services.

J jump to incidentP pin to compareR raw source

Vermont clock✗ VT AG >45 bday34 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 11 days

discovery → filing · 34 weeks / 236 days

Oct 23, 2023

Begins

Nov 3, 2023

Discovered

May 30, 2024

Scope determined

Jun 26, 2024

Filed

vs. sector median

+25 wks slower

This filing is one of 5 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Maine State AGbd_20749848567ed2802024-06-26Verified
Indiana State AGbd_98faef4f7fe7242f2024-06-26Verified
New Hampshire State AGbd_9a8fe933940dea3e2024-06-26Verified
HHS OCRbd_d25e9f87302944172024-06-25 · +1dVerified

Name: The Mount Kisco Surgery Center LLC
norm: the mount kisco surgery center

Name: The Mount Kisco Surgery Center LLC
norm: the mount kisco surgery center
Also named: The Mount Kisco Surgery Center LLCdba oflegal entity
The Ambulatory Surgery Center of Westchesterdba oftrade name
Industry: Healthcarellm

Discovered: Nov 3, 2023
Breach occurred: Oct 23, 2023 – Nov 3, 2023
Undetected for: 11 daysoccurrence → discovery
Materiality determined: May 30, 2024
Notification sent: Jun 26, 2024
Affected individuals: 21,073nationwide
Data types: PIIPHIIdentity (basic)
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Regulator citations: Filed notice with Vermont Attorney General
Initial access: phishing_link

During the incident: Engaged a digital forensics and incident response firm to conduct an investigation
Implemented additional measures to enhance email security
Offering 12 months of complimentary identity protection services through IDX
Changes made: Implemented additional measures to enhance email security
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 34 weeks(236 days from discovery to filing)
Compliance flags: VT AG >45 bday
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

HHS OCRJun 25 · first

Maine State AG+1d

Indiana State AG+1d

New Hampshire State AG+1d

Vermont State AG+1d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ago.vermont.gov/document/2024-06-26-ambulatory-surgery-center-westchester-mount-kisco-surgery-center-data-breach-notice
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 26, 2024
Raw hash: 6063997005e3d9219f727187bd0fac45ad4628455cbd4e4e84d8f78ae9ddd90b

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityThe Mount Kisco Surgery Center LLC

Victim entityThe Mount Kisco Surgery Center LLC

Incidentdiscovered Nov 3, 2023

Stated responseEngaged a digital forensics and incident response firm to conduct an investigation

ComplianceVT AG >45 bday

Extraction provenanceno artifact recorded

Source provenanceago.vermont.gov