HackingHealthcareHealthcareStolen CredentialsTargetedIdentity (basic)LowContained

Grand River Medical Group

bd_8ce8af789d4021bc · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Feb 8, 2021

To disclose

—

Affected

3state residents only

Linked

4 filings

Confidence

66%

Full breach record for Grand River Medical Group →

Grand River Medical Group, P.C. notified patients of unauthorized access to an employee email account. Documents containing names, DOB, and visit types were potentially viewed. No SSN or financial data involved. Forensic analysis found no evidence of exfiltration. MFA implemented and credit monitoring offered.

J jump to incidentP pin to compareR raw source

Incident timeline — partial

? — ?

Breach window unknown

Feb 8, 2021

Filed

—

Corroborated · see linked filings

Compliance clocks stay unassessable until a regulatory filing lands. Dashed segments fill in automatically when corroboration arrives.

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Indiana State AGbd_e7e1c1c71ed3b46c2021-02-08Verified
HHS OCRbd_a7d66cecca5a4d512021-02-12 · +4dVerified
Maine State AGbd_b1dfa9db3f8119582021-02-12 · +4dCandidate

Name: Grand River Medical Group
norm: grand river medical

Name: Grand River Medical Group
norm: grand river medical
Industry: Healthcarellm

Discovered: —
Materiality determined: —
Notification sent: Feb 8, 2021
Affected individuals: 3state-resident count only
Data types: Identity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Initial access: valid_credentials

During the incident: Terminated the unauthorized individual’s access to any part of our system
Engaged outside incident response experts to conduct a forensic analysis
Changed all relevant passwords
Added multi-factor authentication
Isolated the compromised account from the system
Implemented all additional safeguards recommended by our third-party forensic consultants
Changes made: Added multi-factor authentication
Implemented all additional safeguards recommended by our third-party forensic consultants
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Indiana State AGFeb 8 · first

Montana State AGFeb 8 · first · this page

HHS OCR+4d

Maine State AG+4d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/grandSamp.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 8, 2021
Raw hash: e38f359d992a443be90b646a34be8baf8ab881eed2b7b9e9d5cde3adbc3c5b99

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityGrand River Medical Group

Victim entityGrand River Medical Group

IncidentUnauthorized Access

Stated responseTerminated the unauthorized individual’s access to any part of our system

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov