AccidentalHealthcareTechnologyHealthcareMisconfigurationCustomer Data InvolvedDelayed DiscoveryPHIHealth (basic)Identity (basic)LowContained

MSCRIPTS

bd_99c22a97c6b2ad6b · schema v1 · pii pii-v1

Severity

Low

Discovered

Nov 18, 2022

Filed

Mar 14, 2023

To disclose

17 weeks

Affected

Not disclosed

Linked

4 filings

Confidence

64%

Full breach record for MSCRIPTS →4 incidents on file

mscripts, LLC disclosed a misconfiguration of its cloud storage that left prescription management files accessible without authentication from September 30, 2016, to November 18, 2022. The exposed data included patient names, addresses, dates of birth, phone numbers, and prescription details (medication names, refill status). No SSNs or financial data were involved. mscripts engaged forensic investigators and changed access settings upon discovery.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 2240 days

discovery → filing · 17 weeks / 116 days

Sep 30, 2016

Begins

Nov 18, 2022

Discovered

Mar 14, 2023

Filed

vs. sector median

+6 wks slower

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Washington State AGbd_0c0303edc104eef52023-03-14Candidate
Montana State AGbd_65839045a2f364852023-03-14Verified
Oregon State AGbd_f4fa36f617dfea4c2023-03-14Verified

Name: MSCRIPTS
norm: mscripts

Name: MSCRIPTS
norm: mscripts
Industry: HealthcarellmTechnologyllm

Discovered: Nov 18, 2022
Breach occurred: Sep 30, 2016 – Nov 18, 2022
Undetected for: 2,240 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: PHIHealth (basic)Identity (basic)
Attack vector: Misconfiguration

During the incident: Took immediate steps to change the access settings
Began an investigation
Engaged a forensic investigation firm
Thoroughly reviewed the image files to identify the patient and associated pharmacy
Advised the pharmacy client (CE Name)
Established a dedicated toll-free call center
Changes made: Taken measures to address the underlying issue
Will continue to look for ways to further enhance the security measures applicable to the services we provide
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 17 weeks(116 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Washington State AGMar 14 · first

Montana State AGMar 14 · first

Oregon State AGMar 14 · first

California State AGMar 14 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-564325
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 14, 2023
Raw hash: 5c145ec54afafff97533383520a4a2fbbe35d5b2a6f961fff35c95f38c65d3a1

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityMSCRIPTS

Victim entityMSCRIPTS

Incidentdiscovered Nov 18, 2022

Stated responseTook immediate steps to change the access settings

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov