HackingHealthcareHealthcareStolen CredentialsCustomer Data InvolvedIdentity (basic)Government IDHighContained

Medscan Laboratory, Inc. (Adaptive Health Integrations

bd_a7718587f1db8cc9 · schema v1 · pii pii-v1

Severity

High

Discovered

Oct 17, 2021

Filed

Apr 27, 2022

To disclose

27 weeks

Affected

2,968state residents only

Linked

4 filings

Confidence

69%

Full breach record for Medscan Laboratory, Inc. (Adaptive Health Integrations →

Medscan Laboratory, Inc. (d/b/a Adaptive Health Integrations) notified Washington AG that an unauthorized individual accessed systems on Oct 17, 2021. Data included names, DOBs, contact info, and SSNs. 2,968 WA residents affected. Notices sent April 2022; credit monitoring offered.

J jump to incidentP pin to compareR raw source

Washington clock✗ WA AG >90d27 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 27 weeks / 192 days

Oct 17, 2021

Begins

Oct 17, 2021

Discovered

Apr 27, 2022

Filed

vs. sector median

+15 wks slower

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Maine State AGbd_c14fd9a9345cf9702022-04-18 · +9dVerified
California State AGbd_2aea96b7b3d91ade2022-04-15 · +12dVerified
Illinois State AGbd_d787e6ae1425ec272022-01-01 · +116dCandidate

Name: MCDONALD HOPKINS LLC
norm: mcdonald hopkins

Name: Medscan Laboratory, Inc. (Adaptive Health Integrations
norm: medscan laboratory inc adaptive health integrations
Industry: Healthcarellm

Discovered: Oct 17, 2021
Breach occurred: Oct 17, 2021
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 5, 2022
Affected individuals: 2,968state-resident count only
Data types: Identity (basic)Government ID
Data elements: NameSocial Security numberDate of birth
WA-stated cause: Unauthorized Access
WA-stated duration: lifecycle Unknowndexposure Unknownd
WA-stated discovery: Found after the fact
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Provided notification to the Washington Attorney General Consumer Protection Division
Initial access: valid_credentials

During the incident: Contained the threat by disabling unauthorized access to its network
Commenced a prompt and thorough investigation with assistance from external cybersecurity professionals
Providing the affected residents with written notification of this incident via mail
Offering the affected residents complimentary one-year membership with a credit monitoring service
Changes made: Continually evaluates and modifies its practices to enhance the security and privacy of the personal information it maintains
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 27 weeks(192 days from discovery to filing)
Compliance flags: WA AG >90d
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Illinois State AGJan 1 · first

California State AG+104d

Maine State AG+107d

Washington State AG+116d · this page

Pattern: first filing Jan 1 (IL), last Apr 27 (WA) — a 116-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM13448.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 27, 2022
Raw hash: 1790ff5387343970b3e64684238e942c0983e7f1c57ccc50005d06002b260e65

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityMCDONALD HOPKINS LLC

Victim entityMedscan Laboratory, Inc. (Adaptive Health Integrations

Incidentdiscovered Oct 17, 2021

Stated responseContained the threat by disabling unauthorized access to its network

ComplianceWA AG >90d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com