HackingHealthcareHealthcareData ExfiltratedCustomer Data InvolvedGovernment IDIdentity (basic)CriticalContained

Medical Review Institute of America

bd_b7d4763ef84ebad1 · schema v1 · pii pii-v1

Severity

Critical

Discovered

Nov 9, 2021

Filed

Jul 13, 2022

To disclose

35 weeks

Affected · nationwide

170,014293 in this filing

Linked

28 filings

Confidence

66%

Full breach record for Medical Review Institute of America →

Medical Review Institute of America experienced an external system breach (hacking) on November 2, 2021, discovered on November 9, 2021. The incident affected 170,014 individuals, including 293 Maine residents. Acquired data included names and Social Security Numbers. The entity provided written notification and offered 12 months of credit monitoring and identity theft protection through Kroll.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Nov 9, 2021 → Filed with AG Jul 13, 2022246d ✗ ME AG >90d35 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 7 days

discovery → filing · 35 weeks / 246 days

Nov 2, 2021

Begins

Nov 9, 2021

Discovered

Jul 13, 2022

Filed

vs. sector median

+23 wks slower

This filing is one of 28 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

California State AGbd_99bd469703a810be2022-07-13Verified by operator
New Hampshire State AGbd_0419f8046cf11a832022-07-16 · +3dVerified by operator
New Hampshire State AGbd_f9c8e0a19de550ed2022-07-16 · +3dVerified by operator
California State AGbd_0d6158d9c6700f782022-05-10 · +64dVerified by operator

Show 6 more filings ↓up to 174d gap

California State AGbd_9e29b8e3584b22802022-10-03 · +82dVerified by operator
New Hampshire State AGbd_838ab18b44e7e3882022-03-14 · +121dVerified by operator
Maine State AGbd_3d174f7229de2ff32022-02-03 · +160dVerified
California State AGbd_ae43d458dae1f29d2022-02-03 · +160dVerified
New Hampshire State AGbd_1684aaa6efb0e0ed2022-01-21 · +173dVerified
HHS OCRbd_1e14ec3cbf1451dc2022-01-20 · +174dVerified by operator

Showing first 10 of 27 linked disclosures.

Name: Medical Review Institute of America
norm: medical review institute of america
Domain: mrioa.com

Name: Medical Review Institute of America
norm: medical review institute of america
Domain: mrioa.com
Industry: Healthcarellm

Discovered: Nov 9, 2021
Breach occurred: Nov 2, 2021
Undetected for: 7 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 3, 2022
Affected individuals: 170,014state + nationwide
Data types: Government IDIdentity (basic)
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: ExternalFinancial
Regulator citations: Filed data breach notice with Maine Attorney General's office
Initial access: exploit_public_facing

During the incident: Sent written notification to affected consumers
Offered 12 Months of credit monitoring and identity theft protection through Kroll
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 35 weeks(246 days from discovery to filing)
Compliance flags: ME AG >90d · 246dME resident >60d · 86d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Nov 9, 2021
→ Filed with AG: Jul 13, 2022
246d 90 days ME AG >90d
Maine
Discovered: Nov 9, 2021
→ Notified: Feb 3, 2022
86d 60 days (analyst band; statutory cap is 30 days) ME resident >60d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Nov 9, 2021 → Filed with AG: Jul 13, 2022	246d	90 days	ME AG >90d
Maine	Discovered: Nov 9, 2021 → Notified: Feb 3, 2022	86d	60 days (analyst band; statutory cap is 30 days)	ME resident >60d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 4 states

View merged incident ↗

HHS OCRJan 20 · first

New Hampshire State AG+1d

Maine State AG+14d

California State AG+14d

New Hampshire State AG+53d

California State AG+110d

California State AG+174d

Maine State AG+174d · this page

New Hampshire State AG+177d

California State AG+256d

Pattern: first filing Jan 20 (UT), last Oct 3 (CA) — a 256-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Cascade drawn from the first 10 linked disclosures of 27 — the full spread may be wider.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/09aecfa4-2b00-41c8-ab03-2970d1441967.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 13, 2022
Raw hash: 27c608ad45ff3aba658df0b0b14d2f8f74b3aff79bcd2f64f87a5b2e22c827bb

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entityMedical Review Institute of America

Victim entityMedical Review Institute of America

Incidentdiscovered Nov 9, 2021

Stated responseSent written notification to affected consumers

ComplianceME AG >90d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov