HackingHealthcareTechnologyHealthcareStolen CredentialsTargetedIdentity (basic)PHIHealth (basic)PIILowContained

Medical Practice Solutions

bd_8eaf568eb0713dd7 · schema v1 · pii pii-v1

Severity

Low

Discovered

Aug 18, 2021

Filed

Mar 17, 2022

To disclose

30 weeks

Affected

2state residents only

Linked

3 filings

Confidence

66%

Full breach record for Medical Practice Solutions →2 incidents on file

Medical Practice Solutions, Inc. (MPS) notified Montana residents of a security incident where an unauthorized party accessed an email account from August 17-18, 2021. The breach exposed patient contact info, PHI, and billing data. MPS terminated access, reset passwords, and implemented MFA.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 1 days

discovery → filing · 30 weeks / 211 days

Aug 17, 2021

Begins

Aug 18, 2021

Discovered

Mar 17, 2022

Filed

vs. sector median

+19 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_2e9d7d90889c44c92022-03-17Candidate
Indiana State AGbd_92c94de70a388dc82022-03-21 · +4dVerified

Name: Medical Practice Solutions
norm: medical practice

Name: Medical Practice Solutions
norm: medical practice
Industry: HealthcarellmTechnologyllm

Discovered: Aug 18, 2021
Breach occurred: Aug 17, 2021 – Aug 18, 2021
Undetected for: 1 dayoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 2state-resident count only
Data types: Identity (basic)PHIHealth (basic)PII
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Initial access: valid_credentials

During the incident: Terminated the unauthorized party’s access to the affected email account
Resetting the password for the email account where the unauthorized activity was detected
Added two-factor authentication to restrict remote access to its employees’ e-mail accounts
Increasing security training requirements for all its employees to identify and defend against cyberattacks and social engineering techniques
Changes made: Added two-factor authentication to restrict remote access to its employees’ e-mail accounts
Increasing security training requirements for all its employees to identify and defend against cyberattacks and social engineering techniques
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 30 weeks(211 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Massachusetts State AGMar 17 · first

Montana State AGMar 17 · first · this page

Indiana State AG+4d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-Notification-Letter-269.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 17, 2022
Raw hash: 798283466ad9e81bd5d08e7ee86847465b064b25b096f88ef7179c194afb9f80

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityMedical Practice Solutions

Victim entityMedical Practice Solutions

Incidentdiscovered Aug 18, 2021

Stated responseTerminated the unauthorized party’s access to the affected email account

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov