MalwareHealthcareHealthcareRansomwareData EncryptedData ExfiltratedCustomer Data InvolvedGovernment IDIdentity (basic)Financial accountHealth (basic)MediumContained

Bruce L. Boros, M.D., P.A.

bd_9966d365cc8a4f03 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 11, 2020

Filed

Nov 17, 2020

To disclose

10 weeks

Affected

37state residents only

Linked

4 filings

Confidence

66%

Full breach record for Bruce L. Boros, M.D., P.A. →2 incidents on file

Bruce L. Boros, M.D., P.A. DBA Advanced Urgent Care reported a supplemental breach to the New Hampshire Attorney General on November 13, 2020. A ransomware infection on March 1, 2020 encrypted files on a backup drive. A forensic investigation discovered on September 11, 2020, that the impacted data contained personal information (names, SSNs, bank account info) of 37 New Hampshire residents. No evidence of misuse was found. Affected individuals received notification on November 6, 2020, and were offered one year of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 194 days

discovery → filing · 10 weeks / 67 days

Mar 1, 2020

Begins

Sep 11, 2020

Discovered

Nov 17, 2020

Filed

vs. sector median

2 wks faster

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Montana State AGbd_213aab3d7b732cb22020-11-06 · +11dVerified
California State AGbd_91173fd696b722b62020-11-06 · +11dCandidate
HHS OCRbd_f10e30818a6780b22020-11-06 · +11dVerified

Name: MCDONALD HOPKINS LLC
norm: mcdonald hopkins

Name: Bruce L. Boros, M.D., P.A.
norm: bruce l boros md
Industry: healthcare
Also named: Bruce L. Boros, M.D., P.A.dba oflegal entity
Advanced Urgent Caredba oftrade name
Industry: Healthcarellm

Discovered: Sep 11, 2020
Breach occurred: Mar 1, 2020
Undetected for: 194 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 6, 2020
Affected individuals: 37state-resident count only
Data types: Government IDIdentity (basic)Financial accountHealth (basic)
Data elements: Social Security number
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for Impact
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney General

During the incident: Engaged external cybersecurity professionals experienced in handling these types of incidents
Conducted extensive forensic investigation and comprehensive manual document review
Provided affected residents with written notification
Offered affected residents with impacted Social Security numbers a complimentary one-year membership with a credit monitoring service
Advised affected residents about the process for placing fraud alerts and/or security freezes on their credit files
Provided contact information for consumer reporting agencies and the Federal Trade Commission
Changes made: Implemented additional technical safeguards to safeguard information
Educated workforce members on identifying and responding to security incidents
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 10 weeks(67 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Montana State AGNov 6 · first

California State AGNov 6 · first

HHS OCRNov 6 · first

New Hampshire State AG+11d · this page

Pattern: first filing Nov 6 (MT), last Nov 17 (NH) — a 11-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/boros-advanced-urgent-care-20201117.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 17, 2020
Raw hash: 05dbf499e575f99c2b6f934bbcfd53502554453d0080f8c1f14d19d23cfdb326

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityMCDONALD HOPKINS LLC

Victim entityBruce L. Boros, M.D., P.A.

Incidentdiscovered Sep 11, 2020

Stated responseEngaged external cybersecurity professionals experienced in handling these types of incidents

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov