AccidentalHealthcareTechnologyHealthcareMisdeliveryCustomer Data InvolvedData ExfiltratedIdentity (basic)Government IDFinancial accountMediumContained

MedEvolve

bd_a0496aa58a430ab5 · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 11, 2018

Filed

Jul 10, 2018

To disclose

9 weeks

Affected

84state residents only

Linked

8 filings

Confidence

66%

Full breach record for MedEvolve →

MedEvolve, a healthcare billing services provider, notified New Hampshire regulators of a data breach affecting 84 state residents. On May 11, 2018, MedEvolve discovered an FTP file containing patient PII (names, SSNs, addresses) was inadvertently accessible online from March 29 to May 4, 2018, and subject to unauthorized access starting March 29. MedEvolve engaged forensic investigators, secured the portal, and provided 2 years of credit monitoring to affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 43 days

discovery → filing · 9 weeks / 60 days

Mar 29, 2018

Begins

May 11, 2018

Discovered

Jul 10, 2018

Filed

vs. sector median

4 wks faster

This filing is one of 8 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (7) · sorted by filing gap

California State AGbd_0bd4122eff0cddb42018-07-10Verified
Massachusetts State AGbd_2cc6cf8c3756184a2018-07-10Verified
HHS OCRbd_6ac38550f52fc8d32018-07-10Verified
Montana State AGbd_a2d9849fbe9658052018-07-10Verified

Show 3 more filings ↓up to 1771d gap

New Hampshire State AGbd_0f2d25b2273b13f32018-07-27 · +17dVerified by operator
Massachusetts State AGbd_9f8a44684fb3d8bb2018-07-30 · +20dVerified by operator
HHS OCR enforcementbd_43a0abb3eba49ad42023-05-16 · +1771dVerified by operator

Name: FisherBroyles LLP
norm: fisherbroyles

Name: MedEvolve
norm: medevolve
Industry: HealthcarellmTechnologyllm

Discovered: May 11, 2018
Breach occurred: Mar 29, 2018 – May 4, 2018
Undetected for: 43 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 10, 2018
Affected individuals: 84state-resident count only
Data types: Identity (basic)Government IDFinancial account
Attack vector: Misconfiguration
MITRE ATT&CK: T1074 Data Staged
Threat actor: ExternalFinancial
Regulator citations: Notified the U.S. Department of Health and Human ServicesNotified additional required state regulatorsNotified the three consumer reporting agencies

During the incident: Secured the portal in question and took steps to prevent further access
Hired a third-party forensic investigator to conduct an exhaustive investigation
Began conducting a review of its security practices, policies and procedures and updated them as appropriate
Initiated updated Security Risk Analysis and Security Risk Management Plans
Sanctioned the employee responsible
Retrained workforce members
Put additional physical security measures into place
Mailed letters to impacted individuals
Provided two years of credit monitoring services through TransUnion
Informed the U.S. Department of Health and Human Services
Notified additional required state regulators
Notified the three consumer reporting agencies
Changes made: Conducted a review of its security practices, policies and procedures and updated them as appropriate
Initiated updated Security Risk Analysis and Security Risk Management Plans
Retrained workforce members
Put additional physical security measures into place
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(60 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 5 states

View merged incident ↗

California State AGJul 10 · first

Massachusetts State AGJul 10 · first

HHS OCRJul 10 · first

Montana State AGJul 10 · first

New Hampshire State AGJul 10 · first · this page

New Hampshire State AG+17d

Massachusetts State AG+20d

HHS OCR enforcement+1771d

Pattern: first filing Jul 10 (CA), last May 16 — a 1771-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/medevolve-20180710.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 10, 2018
Raw hash: 2d0ed4f97480c84453cce558dcb9892c3c67d68365b603d633c879457561056c

Linked disclosures

Regulatory filings (7) · sorted by filing gap

Reporting entityFisherBroyles LLP

Victim entityMedEvolve

Incidentdiscovered May 11, 2018

Stated responseSecured the portal in question and took steps to prevent further access

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov