MalwareHealthcareTechnologyHealthcareRansomwareData EncryptedIdentity (basic)Government IDPIIHighContained

Health Management Concepts, Inc.

bd_9b14b35615fc8923 · schema v1 · pii pii-v1

Severity

High

Discovered

Jul 16, 2018

Filed

Aug 22, 2018

To disclose

5 weeks

Affected · nationwide

2,58717 in this filing

Linked

4 filings

Confidence

66%

Full breach record for Health Management Concepts, Inc. →3 incidents on file

Health Management Concepts, Inc. (HMC) notified 2,587 individuals of a ransomware incident affecting a file-sharing server. Discovered July 16, 2018, the attack exposed names, SSNs, and health insurance info. HMC engaged forensic investigators, decrypted files, and offered one year of Experian IdentityWorks credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 5 weeks / 37 days

Jul 16, 2018

Discovered

Aug 22, 2018

Filed

vs. sector median

7 wks faster

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Oregon State AGbd_12623a169504c70a2018-08-22Candidate
HHS OCRbd_f4683e2da8db67bf2018-08-22Verified
New Hampshire State AGbd_ce92c498079cac1c2018-08-20 · +2dVerified

Name: Health Management Concepts, Inc.
norm: health management concepts

Name: Health Management Concepts, Inc.
norm: health management concepts
Industry: HealthcarellmTechnologyllm

Discovered: Jul 16, 2018
Materiality determined: —
Notification sent: Aug 22, 2018
Affected individuals: 2,587state + nationwide
Data types: Identity (basic)Government IDPII
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1078 Valid Accounts
Threat actor: ExternalFinancial

During the incident: Took immediate steps to decrypt the files
Provisioned a new server
Began an investigation
Engaged a leading forensic firm to assist us
Offering a complimentary one-year membership in Experian’s IdentityWorksSM Credit 3B
Changes made: Adding enhanced security protocols to our current server
Removing access to the server through Remote Desktop Protocol
Migrating our server to another cloud computing service
Reviewed and, where necessary, enhanced our security protocols
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(37 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

New Hampshire State AGAug 20 · first

Oregon State AG+2d

HHS OCR+2d

Montana State AG+2d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/Health-Management-Concepts-Inc.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 22, 2018
Raw hash: 6543f6ca467a42562228169dfde516e45d7c2bae2ce2b1c1ac83eb3180831206

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityHealth Management Concepts, Inc.

Victim entityHealth Management Concepts, Inc.

Incidentdiscovered Jul 16, 2018

Stated responseTook immediate steps to decrypt the files

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov