HackingHealthcareHealthcareData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDFinancial accountHealth (basic)CredentialsMediumContained

New Jersey Brain and Spine

bd_9cb0bf55c2fff68a · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 16, 2021

Filed

Apr 14, 2022

To disclose

21 weeks

Affected

11state residents only

Linked

6 filings

Confidence

66%

Full breach record for New Jersey Brain and Spine →2 incidents on file

New Jersey Brain & Spine notified NH AG of a cybersecurity incident discovered Nov 16, 2021, involving unauthorized access to patient data. 11 NH residents affected. Data included PHI, SSNs, financial info, and credentials. Remediation included cloud migration, MFA, and new server. Credit monitoring offered.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 21 weeks / 149 days

Nov 16, 2021

Discovered

Apr 14, 2022

Filed

vs. sector median

+9 wks slower

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Montana State AGbd_144958525a52f7ca2022-04-08 · +6dVerified
Indiana State AGbd_50450d6389e21dbb2022-04-08 · +6dVerified
Massachusetts State AGbd_aae3f3f7b0f7ad992022-04-08 · +6dVerified
Maine State AGbd_c6eb25ae4babc5552022-04-08 · +6dVerified

Show 1 more filing ↓up to 103d gap

Illinois State AGbd_5160ed01171992722022-01-01 · +103dCandidate

Name: Wilson, Elser, Moskowitz, Edelman & Dicker LLP
norm: wilson elser moskowitz edelman dicker
Domain: wilsonelser.com

Name: New Jersey Brain and Spine
norm: new jersey brain and spine
Domain: njbrainspine.com
Industry: Healthcarellm

Discovered: Nov 16, 2021
Materiality determined: —
Notification sent: Apr 8, 2022
Affected individuals: 11state-resident count only
Data types: Identity (basic)Government IDFinancial accountHealth (basic)Credentials
Data elements: Social Security numberDate of birthMedical information
Attack vector: Unauthorized Access
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney GeneralPosted substitute notice on website pursuant to HIPAASent media notice to New York Post, New Jersey Star-Ledger, and Tampa Bay Times

During the incident: Engaged a specialized cybersecurity firm to conduct a forensic investigation
Moved quickly to investigate and respond to the Incident
Assessed the security of its systems
Notified potentially affected individuals
Offered twelve (12) months of complimentary credit monitoring and identity theft restoration services
Changes made: Migrated to a third-party hosted cloud-based platform to securely store patient data
Implemented two-factor authentication
Installed a new server
Implemented ongoing monitoring response which tracks user activity, services and ports and coordinates logging
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 21 weeks(149 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Illinois State AGJan 1 · first

Montana State AG+97d

Indiana State AG+97d

Massachusetts State AG+97d

Maine State AG+97d

New Hampshire State AG+103d · this page

Pattern: first filing Jan 1 (IL), last Apr 14 (NH) — a 103-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/new-jersey-brain-spine-20220414.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 14, 2022
Raw hash: bd9fa1ae2dbe3b8e3c0443c3dcb6f9fae4a172e80360dd1f88b0afa9862d3a00

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityWilson, Elser, Moskowitz, Edelman & Dicker LLP

Victim entityNew Jersey Brain and Spine

Incidentdiscovered Nov 16, 2021

Stated responseEngaged a specialized cybersecurity firm to conduct a forensic investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov