MalwareHealthcareTechnologyHealthcareRansomwareData EncryptedTargetedIdentity (basic)Government IDMediumContained

Health Management Concepts, Inc.

bd_977ddd5b9fc37e50 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 25, 2018

Filed

Jun 11, 2018

To disclose

20 weeks

Affected

4state residents only

Linked

2 filings

Confidence

67%

Full breach record for Health Management Concepts, Inc. →3 incidents on file

Health Management Concepts, Inc. notified the NH AG of a ransomware incident affecting 4 NH residents. Discovered Jan 25, 2018, notification sent June 11, 2018. Encrypted files contained names and SSNs. No evidence of actual access. Remediation included forensic investigation, MFA implementation, and staff training.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 20 weeks / 137 days

Jan 25, 2018

Discovered

Jun 11, 2018

Filed

vs. sector median

+7 wks slower

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_82b26bbe429631d22018-06-11Verified

Name: BAKER & HOSTETLER LLP
norm: baker hostetler

Name: Health Management Concepts, Inc.
norm: health management concepts
Industry: HealthcarellmTechnologyllm

Discovered: Jan 25, 2018
Materiality determined: —
Notification sent: Jun 11, 2018
Affected individuals: 4state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for Impact
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney General

During the incident: Secured the employee's computer
Restored relevant files from backup
Took steps to prevent any remote access to HMC's systems
Began an investigation
Engaged a leading forensic firm
Began notifying four New Hampshire residents via U.S. mail
Offering eligible individuals one year of complimentary credit monitoring and identity protection services
Established a call center
Changes made: Conducted an extensive audit of its systems and related system access from outside entities
Implementing the recommendations from that audit
Providing additional monitoring of attempts to enter its systems through firewalls, open DNS ports, and emails
Adding multi-factor authentication on key administrative accounts
Providing additional staff training
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 20 weeks(137 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Massachusetts State AGJun 11 · first

New Hampshire State AGJun 11 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/health-management-20180611.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 11, 2018
Raw hash: ccd034bea88dc171f5dc93510cec06ecbe00ad4c08a466cbc5f0ed105dd142a0

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityBAKER & HOSTETLER LLP

Victim entityHealth Management Concepts, Inc.

Incidentdiscovered Jan 25, 2018

Stated responseSecured the employee's computer

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov