HackingHealthcareHealthcareStolen CredentialsTargetedPHIHealth (basic)Identity (basic)LowContained

Clinic of North Texas, LLP

bd_bf6ba43797edc32f · schema v1 · pii pii-v1

Severity

Low

Discovered

Nov 9, 2021

Filed

Mar 17, 2022

To disclose

18 weeks

Affected

68state residents only

Linked

4 filings

Confidence

65%

Full breach record for Clinic of North Texas, LLP →

Clinic of North Texas, LLP notified patients of a cyber attack discovered on November 9, 2021, involving unauthorized access to patient information including names, addresses, DOBs, and limited health data. The company engaged forensic investigators, reset passwords, implemented MFA, and deployed EDR tools. Affected individuals were offered 12 months of credit monitoring and identity theft protection.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 18 weeks / 128 days

Nov 9, 2021

Discovered

Mar 17, 2022

Filed

vs. sector median

+6 wks slower

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

California State AGbd_7974f299bfc2b20d2022-03-18 · +1dVerified
HHS OCRbd_a182575e2415e6e82022-03-18 · +1dCandidate
Illinois State AGbd_7fec5626199fc3222022-01-01 · +75dCandidate

Name: Clinic of North Texas, LLP
norm: clinic of north texas

Name: Clinic of North Texas, LLP
norm: clinic of north texas
Industry: Healthcarellm

Discovered: Nov 9, 2021
Materiality determined: —
Notification sent: Mar 18, 2022
Affected individuals: 68state-resident count only
Data types: PHIHealth (basic)Identity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Initial access: valid_credentials

During the incident: Engaged a third party cybersecurity firm to conduct a forensics investigation
Changed all administrator passwords
Implemented two-factor authentication
Deployed end point detection and response and threat hunting tools
Arranged for IDX to provide complimentary credit monitoring services, Dark Web monitoring services, and identity theft protection services
Changes made: Changed all administrator passwords
Implemented two-factor authentication
Deployed end point detection and response and threat hunting tools
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 18 weeks(128 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Illinois State AGJan 1 · first

Montana State AG+75d · this page

California State AG+76d

HHS OCR+76d

Pattern: first filing Jan 1 (IL), last Mar 18 (TX) — a 76-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-Notification-Letter-270.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 17, 2022
Raw hash: 30ac3df11eaec89753792dbd1265677a8a1eae8adcf0b6e55337134c9ea1342c

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityClinic of North Texas, LLP

Victim entityClinic of North Texas, LLP

Incidentdiscovered Nov 9, 2021

Stated responseEngaged a third party cybersecurity firm to conduct a forensics investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov