MalwareHealthcareHealthcareRansomwareData EncryptedData ExfiltratedIdentity (basic)Government IDHealth (basic)PHIMediumContained

Crystal Lake Clinic PC

bd_bf15d88c886b5992 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 26, 2020

Filed

Apr 12, 2021

To disclose

33 weeks

Affected

3state residents only

Linked

4 filings

Confidence

67%

Full breach record for Crystal Lake Clinic PC →

Crystal Lake Clinic PC notified the NH AG of a ransomware incident discovered Aug 26, 2020. 3 NH residents affected. Data included names, driver's licenses, and PHI. Notification sent April 9, 2021. HHS OCR also notified.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 33 weeks / 229 days

Aug 26, 2020

Discovered

Apr 12, 2021

Filed

vs. sector median

+20 wks slower

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

HHS OCRbd_150db8d834a1e5042021-04-09 · +3dVerified
Massachusetts State AGbd_4ab1567e37fb95a52021-04-09 · +3dVerified
Montana State AGbd_6c9da17559e75e492021-04-09 · +3dCandidate

Name: Crystal Lake Clinic PC
norm: crystal lake clinic

Name: Crystal Lake Clinic PC
norm: crystal lake clinic
Industry: Healthcarellm

Discovered: Aug 26, 2020
Materiality determined: —
Notification sent: Apr 9, 2021
Affected individuals: 3state-resident count only
Data types: Identity (basic)Government IDHealth (basic)PHI
Data elements: Medical information
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notification of this matter has also been provided to the U.S. Department of Health and Human Services Office for Civil Rights

During the incident: Launched an investigation in consultation with outside cybersecurity professionals
Providing the affected residents with written notification
Advising the affected residents about the process for placing fraud alerts and/or security freezes on their credit files
Providing the contact information for the consumer reporting agencies and the Federal Trade Commission
Providing the affected residents with steps to take to safeguard themselves against medical identity theft
Changes made: Continually evaluates and modifies its practices and internal controls to enhance the security and privacy of personal information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 33 weeks(229 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

HHS OCRApr 9 · first

Massachusetts State AGApr 9 · first

Montana State AGApr 9 · first

New Hampshire State AG+3d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/crystal-lake-clinic-20210412.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 12, 2021
Raw hash: 9044f74aae62f4c0e1870db6fc55bb0b009d4cb08440da98caeb9b8310360f5f

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityCrystal Lake Clinic PC

Victim entityCrystal Lake Clinic PC

Incidentdiscovered Aug 26, 2020

Stated responseLaunched an investigation in consultation with outside cybersecurity professionals

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov