Social EngineeringHealthcareHealthcarePhishingTargetedPIIIdentity (basic)Government IDMediumContained

Platinum Performance, Inc.

bd_b9c4ca6eeb568c53 · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 6, 2022

Filed

Aug 31, 2022

To disclose

17 weeks

Affected

2state residents only

Linked

3 filings

Confidence

66%

Full breach record for Platinum Performance, Inc. →2 incidents on file

Platinum Performance, Inc. notified Montana residents of a phishing incident that compromised two employee email accounts. Unauthorized access occurred on September 8, 2021, and was discovered on May 6, 2022. Personal information, including government identifiers, was potentially exposed. The company engaged forensic experts, notified law enforcement, and provided two years of free identity monitoring via Kroll.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 240 days

discovery → filing · 17 weeks / 117 days

Sep 8, 2021

Begins

May 6, 2022

Discovered

Aug 31, 2022

Filed

vs. sector median

+6 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Indiana State AGbd_df33d5ef76f56bcd2022-08-31Verified
Maine State AGbd_fd80e45ffe93519c2022-08-31Verified by operator

Name: Platinum Performance, Inc.
norm: platinum performance

Name: Platinum Performance, Inc.
norm: platinum performance
Industry: Healthcarellm

Discovered: May 6, 2022
Breach occurred: Sep 8, 2021
Undetected for: 240 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 2state-resident count only
Data types: PIIIdentity (basic)Government ID
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid Accounts
Threat actor: External
Regulator citations: Notified law enforcement
Initial access: phishing_link

During the incident: Initiated Cybersecurity and Privacy Incident Response Plans
Engaged third-party forensic experts to conduct an investigation
Took steps to address and contain the incident the same day it was discovered
Notified law enforcement of this incident
Changes made: Enhanced internal security measures to help prevent a similar incident from happening in the future
Secured the expert services of Kroll to provide identity monitoring services at no cost to you for two years
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 17 weeks(117 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Indiana State AGAug 31 · first

Maine State AGAug 31 · first

Montana State AGAug 31 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-Notification-Letter-530.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 31, 2022
Raw hash: ba03a0081ab3d6fbb031b650edbccc54f902764b1d55f33318eb779dd7b889cd

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityPlatinum Performance, Inc.

Victim entityPlatinum Performance, Inc.

Incidentdiscovered May 6, 2022

Stated responseInitiated Cybersecurity and Privacy Incident Response Plans

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov