MalwareHealthcareHealthcareRansomwareData EncryptedIdentity (basic)Government IDHealth (basic)Financial accountCredentialsMediumResolved

Central Kansas Orthopedic Group

bd_ac3a8b57353d3264 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 11, 2019

Filed

Feb 6, 2020

To disclose

12 weeks

Affected

2state residents only

Linked

3 filings

Confidence

66%

Full breach record for Central Kansas Orthopedic Group →

Central Kansas Orthopedic Group (CKOG) disclosed a ransomware attack discovered on November 11, 2019. The attacker deployed ransomware, but CKOG restored systems from backups without paying the ransom. No evidence of data removal was found, though patient records (names, DOB, SSN, health info, driver's license) may have been viewed. CKOG engaged forensic investigators and law enforcement, and offered 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 12 weeks / 87 days

Nov 11, 2019

Discovered

Feb 6, 2020

Filed

vs. sector median

on median

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

HHS OCRbd_f01025c721e4ea8e2020-01-28 · +9dVerified
Indiana State AGbd_7e2372972df02ae72020-01-27 · +10dVerified

Name: Central Kansas Orthopedic Group
norm: central kansas orthopedic

Name: Central Kansas Orthopedic Group
norm: central kansas orthopedic
Industry: Healthcarellm

Discovered: Nov 11, 2019
Materiality determined: —
Notification sent: Jan 23, 2020
Affected individuals: 2state-resident count only
Data types: Identity (basic)Government IDHealth (basic)Financial accountCredentials
Data elements: Social Security numberDate of birth
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1190 Exploit Public-Facing Application
Threat actor: ExternalFinancial
Initial access: exploit_public_facing

During the incident: Engaged outside counsel and a third-party forensic investigator
Notified law enforcement
Shut down unauthorized access immediately
Restored all medical records from backups
Changes made: Offering 12 months of credit and CyberScan monitoring through MyIDCare
Providing $1,000,000 insurance reimbursement policy
Providing fully managed identity theft recovery services
Hardening systems against future attacks based on forensic investigator recommendations
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 12 weeks(87 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Indiana State AGJan 27 · first

HHS OCR+1d

Montana State AG+10d · this page

Pattern: first filing Jan 27 (IN), last Feb 6 (MT) — a 10-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/Ortho-CON.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 6, 2020
Raw hash: 5a6afe78b2b7df83ac31dcae715d2eac6bf839e67cda9f6ddeb4ec4846aef631

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityCentral Kansas Orthopedic Group

Victim entityCentral Kansas Orthopedic Group

Incidentdiscovered Nov 11, 2019

Stated responseEngaged outside counsel and a third-party forensic investigator

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov