AccidentalTechnologyProfessional ServicesInformationMisdeliveryCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDMediumResolved

Medical Science and Computing, LLC

bd_9e1399ecaf10b414 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 29, 2018

Filed

Feb 13, 2018

To disclose

15 days

Affected · nationwide

1372 in this filing

Confidence

66%

Full breach record for Medical Science and Computing, LLC →

Medical Science and Computing, LLC mistakenly emailed W2 forms containing names and SSNs to four individuals on Jan 29, 2018. 137 employees affected. Incident discovered same day. MSC contacted recipients, offered 24 months credit monitoring, and implemented policy banning W2 emails.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 15 days

Jan 29, 2018

Begins

Jan 29, 2018

Discovered

Feb 13, 2018

Filed

vs. sector median

17 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed137 affectedView incident

Name: Medical Science and Computing, LLC
norm: medical science and computing

Name: Medical Science and Computing, LLC
norm: medical science and computing
Industry: TechnologyllmProfessional Servicesllm

Discovered: Jan 29, 2018
Breach occurred: Jan 29, 2018
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 29, 2018
Affected individuals: 137state + nationwide
Data types: Identity (basic)Government ID
Attack vector: Misconfiguration
MITRE ATT&CK: T1074 Data Staged
Regulator citations: Reporting this incident to certain state Attorneys General as required by law

During the incident: Contacted each of the four individuals who received the file in error
Confirmed that only two individuals had actually opened the email
Confirmed that all four individuals promptly deleted the email
Confirmed that individuals had not copied, saved, or used the employee Social Security numbers
Reporting this incident to certain state Attorneys General
Offering access to 24 months of credit monitoring and identity theft restoration services at no cost through AllClear ID
Changes made: Implementing a policy providing that W2 forms may not be sent via email
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 15 days(15 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/Medical-Science-Computing-LLC.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 13, 2018
Raw hash: 8327041b1303c29a6314ffd426c98edd83797c81470ec903ef7891240d2c4270

Reporting entityMedical Science and Computing, LLC

Victim entityMedical Science and Computing, LLC

Incidentdiscovered Jan 29, 2018

Stated responseContacted each of the four individuals who received the file in error

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov