Social EngineeringHealthcareHealthcarePhishingStolen CredentialsSupply Chain (3P Vendor)Business Associate (HIPAA)Customer Data InvolvedWire FraudPHIIdentity (basic)Government IDHealth (basic)Financial accountMediumContained

American Anesthesiology, Inc.

bd_c1cbfd29ce17dc04 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 16, 2020

Filed

Jan 8, 2021

To disclose

25 weeks

Affected

Not disclosed

Linked

7 filings

Confidence

65%

Full breach record for American Anesthesiology, Inc. →2 incidents on file

American Anesthesiology, Inc. notified patients of a security event at its service provider, MEDNAX Services, Inc. An unauthorized party accessed email accounts via phishing between June 17 and June 22, 2020. The incident was discovered on July 16, 2020. Affected data may include patient contact info, SSNs, health insurance details, medical records, and billing information. The attacker attempted unsuccessful payroll fraud. American Anesthesiology terminated access, reset passwords, migrated email systems, and offered credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 29 days

discovery → filing · 25 weeks / 176 days

Jun 17, 2020

Begins

Jul 16, 2020

Discovered

Jan 8, 2021

Filed

vs. sector median

+16 wks slower

This filing is one of 7 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

HHS OCRbd_1c89d410047f27b12021-01-08Verified
Oregon State AGbd_3f02b387fd1197ea2021-01-08Verified
Maine State AGbd_6905374190db86e62021-01-08Verified
Indiana State AGbd_9412215949323f172021-01-08Verified

Show 2 more filings ↓up to 94d gap

Massachusetts State AGbd_c19297281c202d402021-01-09 · +1dVerified
South Carolina State AGbd_19020fa39edc65a52021-04-12 · +94dVerified

Name: American Anesthesiology, Inc.
norm: american anesthesiology

Name: American Anesthesiology, Inc.
norm: american anesthesiology
Industry: Healthcarellm

Discovered: Jul 16, 2020
Breach occurred: Jun 17, 2020 – Jun 22, 2020
Undetected for: 29 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: PHIIdentity (basic)Government IDHealth (basic)Financial account
Data elements: Social Security numberDate of birth
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Third party: via MEDNAX Services, Inc.
Initial access: phishing_link

During the incident: Terminated the unauthorized party’s access to the O365 System
Reset each user’s password for the email accounts where unauthorized activity was detected
Moved email accounts on the O365 system used by American Anesthesiology employees to our email system
Added authentication requirements to restrict access to the email accounts of these American Anesthesiology employees
Offering a one-year, complimentary membership for IdentityWorks SM by Experian
Changes made: Introducing additional authentication and security training requirements for all of our employees in 2021 to counteract phishing and other social engineering techniques
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 25 weeks(176 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 7 states

View merged incident ↗

HHS OCRJan 8 · first

Oregon State AGJan 8 · first

Maine State AGJan 8 · first

Indiana State AGJan 8 · first

California State AGJan 8 · first · this page

Massachusetts State AG+1d

South Carolina State AG+94d

Pattern: first filing Jan 8 (NY), last Apr 12 (SC) — a 94-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-198346
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 8, 2021
Raw hash: 4be3f7adfec09d5208aae1ec98c03ca6fc88191b0a99e025b11653b88bfbd2cc

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityAmerican Anesthesiology, Inc.

Victim entityAmerican Anesthesiology, Inc.

Incidentdiscovered Jul 16, 2020

Stated responseTerminated the unauthorized party’s access to the O365 System

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov