HackingHealthcareHealthcareData ExfiltratedCustomer Data InvolvedGovernment IDIdentity (basic)HighContained

Central Texas Medical Specialists, PLLC

bd_a2803d728e2e776f · schema v1 · pii pii-v1

Severity

High

Discovered

Aug 4, 2021

Filed

Sep 15, 2021

To disclose

6 weeks

Affected · nationwide

36,5037 in this filing

Linked

3 filings

Confidence

66%

Full breach record for Central Texas Medical Specialists, PLLC →2 incidents on file

Central Texas Medical Specialists PLLC (dba Austin Cancer Centers) reported an external system breach (hacking) occurring on July 21, 2021, discovered on August 4, 2021. The incident affected 36,503 individuals, including 7 Maine residents. Acquired data included names and Social Security Numbers. The entity provided written notification and offered one year of Equifax Credit WatchTM Gold identity protection services.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Aug 4, 2021 → Filed with AG Sep 15, 202142d ⏱ ME AG >30d6 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 14 days

discovery → filing · 6 weeks / 42 days

Jul 21, 2021

Begins

Aug 4, 2021

Discovered

Sep 15, 2021

Filed

vs. sector median

6 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

HHS OCRbd_4a8292046d1f79a02021-09-10 · +5dVerified
Indiana State AGbd_3f95ff0fee00123a2021-08-21 · +25dVerified

Name: Central Texas Medical Specialists, PLLC
norm: central texas medical specialists
Industry: Healthcare

Name: Central Texas Medical Specialists, PLLC
norm: central texas medical specialists
Industry: Healthcare
Also named: Central Texas Medical Specialists PLLCdba oflegal entity
Austin Cancer Centersdba oftrade name
Industry: Healthcarellm

Discovered: Aug 4, 2021
Breach occurred: Jul 21, 2021
Undetected for: 14 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 27, 2021
Affected individuals: 36,503state + nationwide
Data types: Government IDIdentity (basic)
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Initial access: exploit_public_facing

During the incident: Sent written notification to affected individuals
Offered Equifax Credit WatchTM Gold identity theft protection services
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(42 days from discovery to filing)
Compliance flags: ME AG >30d · 42d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Aug 4, 2021
→ Filed with AG: Sep 15, 2021
42d 30 days (soft) ME AG >30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Aug 4, 2021 → Filed with AG: Sep 15, 2021	42d	30 days (soft)	ME AG >30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Indiana State AGAug 21 · first

HHS OCR+20d

Maine State AG+25d · this page

Pattern: first filing Aug 21 (IN), last Sep 15 (ME) — a 25-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/c821e44a-6e15-47ee-8ab5-9f1ebd9119f1.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 15, 2021
Raw hash: 156f0f73c84f5d432ba8690e6f8d8f1b2033391cea50f955996514365c662584

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityCentral Texas Medical Specialists, PLLC

Victim entityCentral Texas Medical Specialists, PLLC

Incidentdiscovered Aug 4, 2021

Stated responseSent written notification to affected individuals

ComplianceME AG >30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov