AccidentalTechnologyHealthcareInformationMisdeliveryData ExfiltratedIdentity (basic)Government IDPIIMediumActive

MedEvolve

bd_a2d9849fbe965805 · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 11, 2018

Filed

Jul 10, 2018

To disclose

9 weeks

Affected · nationwide

1513 in this filing

Linked

8 filings

Confidence

65%

Full breach record for MedEvolve →

MedEvolve notified Montana residents of a data breach where an FTP file containing patient PII (names, SSNs, addresses) was inadvertently accessible online from March 29 to May 4, 2018. Unauthorized access occurred on March 29, 2018. 15 individuals were affected. MedEvolve engaged forensic investigators and offered 2 years of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 43 days

discovery → filing · 9 weeks / 60 days

Mar 29, 2018

Begins

May 11, 2018

Discovered

Jul 10, 2018

Filed

vs. sector median

10 wks faster

This filing is one of 8 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (7) · sorted by filing gap

California State AGbd_0bd4122eff0cddb42018-07-10Verified
Massachusetts State AGbd_2cc6cf8c3756184a2018-07-10Verified
HHS OCRbd_6ac38550f52fc8d32018-07-10Verified
New Hampshire State AGbd_a0496aa58a430ab52018-07-10Verified

Show 3 more filings ↓up to 1771d gap

New Hampshire State AGbd_0f2d25b2273b13f32018-07-27 · +17dVerified by operator
Massachusetts State AGbd_9f8a44684fb3d8bb2018-07-30 · +20dVerified by operator
HHS OCR enforcementbd_43a0abb3eba49ad42023-05-16 · +1771dVerified by operator

Name: MedEvolve
norm: medevolve

Name: MedEvolve
norm: medevolve
Industry: TechnologyllmHealthcarellm

Discovered: May 11, 2018
Breach occurred: Mar 29, 2018 – May 4, 2018
Undetected for: 43 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 6, 2018
Affected individuals: 15state + nationwide
Data types: Identity (basic)Government IDPII
Attack vector: Misconfiguration
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Regulator citations: Providing notice to the U.S. Department of Health and Human ServicesProviding notice to state regulators

During the incident: Secured the portal in question
Hired a third-party forensic investigator to conduct an exhaustive investigation
Providing notice to the U.S. Department of Health and Human Services, relevant media outlets, and state regulators
Arranged for complimentary credit monitoring service for two years
Changes made: Working to implement additional safeguards and security measures to enhance the privacy and security of information in our systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(60 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 5 states

View merged incident ↗

California State AGJul 10 · first

Massachusetts State AGJul 10 · first

HHS OCRJul 10 · first

New Hampshire State AGJul 10 · first

Montana State AGJul 10 · first · this page

New Hampshire State AG+17d

Massachusetts State AG+20d

HHS OCR enforcement+1771d

Pattern: first filing Jul 10 (CA), last May 16 — a 1771-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/MedEvolve.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 10, 2018
Raw hash: 1640b35bacff1d56514ddb1f4da2b35b29643be70cef640b728abd9ce969ff8f

Linked disclosures

Regulatory filings (7) · sorted by filing gap

Reporting entityMedEvolve

Victim entityMedEvolve

Incidentdiscovered May 11, 2018

Stated responseSecured the portal in question

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov