MalwareHealthcareTechnologyHealthcareRansomwarePhishingRansom DemandedData EncryptedCustomer Data InvolvedGovernment IDIdentity (basic)Financial accountPIIMediumResolved

ExecuPharm Inc.

bd_a8470fac8c8d843f · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 13, 2020

Filed

Mar 16, 2020

To disclose

3 days

Affected

1state residents only

Linked

5 filings

Confidence

65%

Full breach record for ExecuPharm Inc. →

ExecuPharm Inc. disclosed a March 13, 2020 ransomware incident where attackers encrypted servers via phishing and demanded ransom. Employee and select Parexel personnel data (SSNs, financial info) was potentially accessed. ExecuPharm restored systems, engaged forensic investigators, and provided one year of Kroll identity monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 3 days

Mar 13, 2020

Begins

Mar 13, 2020

Discovered

Mar 16, 2020

Filed

vs. sector median

12 wks faster

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitecl0pbd_acab60010fa7e5572020-03-13 · +3dVerified by operator

Regulatory filings (3) · sorted by filing gap

Massachusetts State AGbd_4ea2294527b6a2902020-04-16 · +31dVerified by operator
New Hampshire State AGbd_dcfeb26245f9198d2020-04-17 · +32dVerified
Indiana State AGbd_f96df19d63ead0bd2020-04-17 · +32dVerified by operator

Name: ExecuPharm Inc.
norm: execupharm

Name: ExecuPharm Inc.
norm: execupharm
Industry: HealthcarellmTechnologyllm

Discovered: Mar 13, 2020
Breach occurred: Mar 13, 2020
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 1state-resident count only
Data types: Government IDIdentity (basic)Financial accountPII
Data elements: Social Security number
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1566.002 Spearphishing LinkT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified federal and local law enforcement authorities
Initial access: phishing_link

During the incident: Retained leading third party cybersecurity firms to investigate the nature and scope of the incident
Notified federal and local law enforcement authorities
Rebuilt the impacted servers from back up servers
Fully restored and secured the ExecuPharm systems
Installation of forensic tools on all systems
Isolation of impacted systems
Implemented additional countermeasures to block further ransomware emails
Upgraded security measures to prevent future attacks
Forced password resets
Multi-factor authentication for remote access
Endpoint protection, detection, and response tools
Secured the services of Kroll to provide identity monitoring
Changes made: Forced password resets
Multi-factor authentication for remote access
Endpoint protection, detection, and response tools
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 3 days(3 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Montana State AGMar 16 · first · this page

Massachusetts State AG+31d

New Hampshire State AG+32d

Indiana State AG+32d

Pattern: first filing Mar 16 (MT), last Apr 17 (IN) — a 32-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/doc-16.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 16, 2020
Raw hash: d77a41923efcd74f2cdc967b04cd8e7a9111a6485c1dad80df19067b7811149b

Linked disclosures

Ransomware claims (1)

Regulatory filings (3) · sorted by filing gap

Reporting entityExecuPharm Inc.

Victim entityExecuPharm Inc.

Incidentdiscovered Mar 13, 2020

Stated responseRetained leading third party cybersecurity firms to investigate the nature and scope of the incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov