Social EngineeringHealthcareHealthcarePhishingStolen CredentialsData ExfiltratedCustomer Data InvolvedEmployee Data InvolvedFinancial accountHealth (basic)Identity (basic)Government IDPHIMediumContained

Christie Business Holdings Company, P.C.

bd_a1eb3d1e4ac146d3 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 10, 2021

Filed

Mar 25, 2022

To disclose

32 weeks

Affected

694state residents only

Linked

5 filings

Confidence

69%

Full breach record for Christie Business Holdings Company, P.C. →

Christie Business Holdings Company, P.C. (Christie Clinic) notified Washington AG of a phishing incident affecting 694 residents. Unauthorized access to a single business email account occurred July 14–Aug 19, 2021. Data exposed included names, SSNs, DOBs, medical, and health insurance info. Notice sent March 25, 2022. Credit monitoring offered.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 27 days

discovery → filing · 32 weeks / 227 days

Jul 14, 2021

Begins

Aug 10, 2021

Discovered

Mar 25, 2022

Filed

vs. sector median

+20 wks slower

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Montana State AGbd_41094ec2336269212022-03-25Verified
HHS OCRbd_c5da4d2f50aa63532022-03-25Verified
Massachusetts State AGbd_d79d45782a7de8d72022-03-25Verified
New Hampshire State AGbd_bbeab82432f036e22022-03-29 · +4dVerified

Name: Christie Business Holdings Company, P.C.
norm: christie business
Domain: christieclinic.com
Industry: Health

Name: Christie Business Holdings Company, P.C.
norm: christie business
Domain: christieclinic.com
Industry: Health
Industry: Healthcarellm

Discovered: Aug 10, 2021
Breach occurred: Jul 14, 2021 – Aug 19, 2021
Undetected for: 27 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 25, 2022
Affected individuals: 694state-resident count only
Data types: Identity (basic)Government IDHealth (basic)Financial account
Data elements: NameSocial Security numberDate of birthHealth insurance IDMedical information
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 200-299dexposure 1-99d
WA-stated discovery: Found after the fact
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Regulator citations: contacted federal law enforcement
Initial access: phishing_link

During the incident: Contacted federal law enforcement and worked with them to mitigate the impact of the unauthorized access
Engaged a leading data forensics firm
Provided access to credit monitoring services for twelve (12) months, through Experian
Providing impacted individuals with guidance on how to better protect against identity theft and fraud
Changes made: Working to implement additional safeguards and training to its employees
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 32 weeks(227 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Montana State AGMar 25 · first

HHS OCRMar 25 · first

Massachusetts State AGMar 25 · first

Washington State AGMar 25 · first · this page

New Hampshire State AG+4d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA6410.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 25, 2022
Raw hash: 366f8f8b7a2c3a7ea17e432c6bfc56db2e251b9d4a681421affb66f18eaba079

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityChristie Business Holdings Company, P.C.

Victim entityChristie Business Holdings Company, P.C.

Incidentdiscovered Aug 10, 2021

Stated responseContacted federal law enforcement and worked with them to mitigate the impact of the unauthorized access

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com