MalwareHealthcareHealthcareRansomwareCapture Stored DataMazeData ExfiltratedData EncryptedCustomer Data InvolvedFinancial accountHealth (basic)Identity (basic)Government IDPHIHighContained

Northwest Eye Surgeons, P.C. and Sight Partners LLC

bd_95acb217fd0a2261 · schema v1 · pii pii-v1

Severity

High

Discovered

May 1, 2020

Filed

Sep 30, 2020

To disclose

22 weeks

Affected

6,809state residents only

Linked

2 filings

Confidence

67%

Full breach record for Northwest Eye Surgeons, P.C. and Sight Partners LLC →2 incidents on file

Northwest Eye Surgeons, P.C. and Sight Partners LLC disclosed a Maze ransomware incident discovered on May 1, 2020. The attack encrypted files and exfiltrated patient data, including SSNs, medical info, and financial data. 6,809 Washington residents were affected. NES engaged forensic investigators, reset passwords, enabled MFA, and offered 2 years of credit monitoring.

J jump to incidentP pin to compareR raw source

Washington clock✗ WA AG >90d22 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

discovery → filing · 22 weeks / 152 days

May 1, 2020

Discovered

Sep 30, 2020

Filed

vs. sector median

+9 wks slower

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

HHS OCRbd_889b0b6040d280162020-10-26 · +26dCandidate

Name: Wilson, Elser, Moskowitz, Edelman & Dicker LLP
norm: wilson elser moskowitz edelman dicker
Domain: wilsonelser.com

Name: Northwest Eye Surgeons, P.C. and Sight Partners LLC
norm: northwest eye surgeons pc and sight
Industry: Healthcarellm

Discovered: May 1, 2020
Materiality determined: —
Notification sent: —
Affected individuals: 6,809state-resident count only
Data types: Financial accountHealth (basic)Identity (basic)Government IDPHI
Data elements: NameSocial Security numberDriver's licence numberDate of birthMedical information
WA-stated cause: Cyberattack
WA-stated duration: lifecycle Unknowndexposure Unknownd
WA-stated discovery: Found after the fact
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified HHS pursuant to HIPAA

During the incident: Initiated an investigation led by an independent forensic firm
Engaged a third-party forensic expert team
Conducted a data mining exercise
Changed all computer passwords
Improved computer security settings by enabling a two-factor authentication system for its emails
Offering complimentary credit monitoring and dark web monitoring services to the affected residents for two years
Changes made: Implementing additional safeguards and security measures to enhance the privacy and security of information in its systems
Enabled a two-factor authentication system for its emails
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 22 weeks(152 days from discovery to filing)
Compliance flags: WA AG >90d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings

View merged incident ↗

Washington State AGSep 30 · first · this page

HHS OCR+26d

Pattern: first filing Sep 30 (WA), last Oct 26 (WA) — a 26-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10329.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 30, 2020
Raw hash: 22621b9f3fa5087ad99fe4c04a205ff4c2a6a9dad0cd3948699c9c63b9247ceb

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityWilson, Elser, Moskowitz, Edelman & Dicker LLP

Victim entityNorthwest Eye Surgeons, P.C. and Sight Partners LLC

Incidentdiscovered May 1, 2020

Stated responseInitiated an investigation led by an independent forensic firm

ComplianceWA AG >90d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com