HackingHealthcareHealthcareStolen CredentialsSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedPHIGovernment IDIdentity (basic)Health (basic)MediumContained

Orthopaedic Institute of Western Kentucky (OIWK)

bd_9e440fad5ef291ae · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Mar 5, 2026

To disclose

—

Affected

Not disclosed

Linked

3 filings

Confidence

66%

Full breach record for Orthopaedic Institute of Western Kentucky (OIWK) →

The Orthopaedic Institute of Western Kentucky (OIWK) notified patients of a cybersecurity incident at third-party vendor Keystone Technologies. Unauthorized third parties accessed systems between April 21–26, 2025, and July 19–August 1, 2025, obtaining files containing patient names, SSNs, DOBs, addresses, medical record numbers, insurance info, and treatment data. OIWK engaged forensic investigators and is transitioning data to Mercy Health. Complimentary credit monitoring is offered.

J jump to incidentP pin to compareR raw source

Leak gap clock✗ Leak >180d

⚠ no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.

Incident timeline

Apr 21, 2025

Begins

Mar 5, 2026

Filed

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitesafepaybd_60fa3579a3075f492025-07-14 · +234dVerified by operator

Regulatory filings (1) · sorted by filing gap

HHS OCRbd_002344de59d649db2026-02-27 · +6dVerified by operator

Name: Orthopaedic Institute of Western Kentucky (OIWK)
norm: orthopaedic institute of western kentucky oiwk
Domain: oiwky.com

Name: Orthopaedic Institute of Western Kentucky (OIWK)
norm: orthopaedic institute of western kentucky oiwk
Domain: oiwky.com
Industry: Healthcarellm

Discovered: —
Breach occurred: Apr 21, 2025 – Aug 1, 2025
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: PHIGovernment IDIdentity (basic)Health (basic)
Data elements: Social Security numberDate of birthMedical information
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
Threat actor: External
Third party: via Keystone Technologies
Initial access: supply_chain

During the incident: Initiated incident response protocols
Began an investigation with the assistance of an external forensic firm
Offering a complimentary 12-month membership in Experian IdentityWorks
Changes made: Transitioning the data maintained by Keystone Technologies to Mercy Health’s internal systems
Source: Quoted from the filing itself, not independently verified.

Compliance flags: Leak >180d
Discovery-date grounding: no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

HHS OCRFeb 27 · first

Massachusetts State AG+6d · this page

Pattern: first filing Feb 27 (KY), last Mar 5 (MA) — a 6-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.mass.gov/doc/2026-328-orthopaedic-institute-of-western-kentucky/download
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 5, 2026
Raw hash: e147e6cb08d93fb6457110564e67b75ccd604a1b4a1a15972308b9bfd05d5426

Linked disclosures

Ransomware claims (1)

Regulatory filings (1) · sorted by filing gap

Reporting entityOrthopaedic Institute of Western Kentucky (OIWK)

Victim entityOrthopaedic Institute of Western Kentucky (OIWK)

IncidentThird-Party / Supply Chain

Stated responseInitiated incident response protocols

ComplianceLeak >180d

Extraction provenanceno artifact recorded

Source provenancewww.mass.gov