Social EngineeringHealthcareHealthcarePhishingStolen CredentialsTargetedData ExfiltratedIdentity (basic)Health (basic)PHILowContained

Medical College of Wisconsin

bd_9b1983e1d1c78a7a · schema v1 · pii pii-v1

Severity

Low

Discovered

Jul 21, 2017

Filed

Nov 17, 2017

To disclose

17 weeks

Affected

3state residents only

Linked

3 filings

Confidence

64%

Medical College of Wisconsin notified patients of a spear phishing attack targeting employee email accounts. Unauthorized access occurred July 21-28, 2017. Compromised accounts contained PHI including names, DOBs, addresses, medical record numbers, and insurance info. No SSNs were involved. Forensic investigation confirmed the scope.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 17 weeks / 119 days

Jul 21, 2017

Begins

Jul 21, 2017

Discovered

Nov 17, 2017

Filed

vs. sector median

+6 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

California State AGbd_5ca941b7c82c93472017-11-17Candidate
Massachusetts State AGbd_fd11ef3201a810082017-11-20 · +3dVerified

Name: Medical College of Wisconsin
norm: medical college of wisconsin
Domain: academyart.edu

Name: Medical College of Wisconsin
norm: medical college of wisconsin
Domain: academyart.edu
Industry: Healthcarellm

Discovered: Jul 21, 2017
Breach occurred: Jul 21, 2017 – Jul 28, 2017
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 14, 2017
Affected individuals: 3state-resident count only
Data types: Identity (basic)Health (basic)PHI
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: External
Initial access: phishing_link

During the incident: Disabled the impacted email accounts
Changed the passwords to those accounts
Maintained heightened monitoring of the accounts
Commenced an investigation of the incident
Retained an independent computer forensic firm to analyze the extent of any compromise
Changes made: Continually evaluate and modify practices to enhance the security and privacy of the patients' information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 17 weeks(119 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

California State AGNov 17 · first

Montana State AGNov 17 · first · this page

Massachusetts State AG+3d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/Medical-College-of-Wisconsin.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 17, 2017
Raw hash: bbef867cc4642ff90b5108fbaf5c23e5c6da5f88c3b8d6ebb8e486260bb0a33a

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityMedical College of Wisconsin

Victim entityMedical College of Wisconsin

Incidentdiscovered Jul 21, 2017

Stated responseDisabled the impacted email accounts

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov