Social EngineeringHealthcareProfessional ServicesHealthcarePhishingTargetedPHIGovernment IDFinancial accountMediumContained

Ivy Rehab Network

bd_bb3fcf9b437fb72c · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 1, 2019

Filed

Nov 26, 2019

To disclose

30 weeks

Affected

2state residents only

Linked

3 filings

Confidence

66%

Full breach record for Ivy Rehab Network →2 incidents on file

Ivy Rehab Network notified Montana residents of a May 2019 phishing campaign that compromised employee email accounts containing patient PHI, SSNs, and financial data. The company engaged forensic investigators, implemented password changes and security training, and offered 12 months of Equifax identity monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 30 weeks / 209 days

May 1, 2019

Discovered

Nov 26, 2019

Filed

vs. sector median

+18 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

South Carolina State AGbd_1b0fad7cc95dd7b02019-11-26Candidate
New Hampshire State AGbd_b73b1fbffce2d2d82019-12-02 · +6dVerified

Name: Ivy Rehab Network
norm: ivy rehab network
Domain: ivyrehab.com

Name: Ivy Rehab Network
norm: ivy rehab network
Domain: ivyrehab.com
Industry: HealthcarellmProfessional Servicesllm

Discovered: May 1, 2019
Materiality determined: —
Notification sent: Nov 25, 2019
Affected individuals: 2state-resident count only
Data types: PHIGovernment IDFinancial account
Data elements: Social Security number
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing Link
Threat actor: External
Regulator citations: working with government agencies where applicable
Initial access: phishing_link

During the incident: Conducted an internal investigation with the assistance of our internal and external IT team
Engaged a leading computer forensic firm to investigate the nature and extent of the unauthorized access
Offering complimentary services to protect you for a period of twelve months
Secured the services of Equifax to provide you with identity monitoring services
Requiring frequent password changes
Providing all staff with ongoing security awareness training
Changes made: Requiring frequent password changes
Providing all staff with ongoing security awareness training
Working with government agencies where applicable
Invest resources to improve our data protection capabilities
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 30 weeks(209 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

South Carolina State AGNov 26 · first

Montana State AGNov 26 · first · this page

New Hampshire State AG+6d

Pattern: first filing Nov 26 (SC), last Dec 2 (NH) — a 6-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-36.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 26, 2019
Raw hash: d6c9a00f1dc8f230d4fd61a787d5718eb558eb04048274c27d3722cf6c107f28

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityIvy Rehab Network

Victim entityIvy Rehab Network

Incidentdiscovered May 1, 2019

Stated responseConducted an internal investigation with the assistance of our internal and external IT team

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov