PhysicalHealthcareTechnologyHealthcareTheftCustomer Data InvolvedEmployee Data InvolvedPHIHealth (basic)Government IDFinancial accountIdentity (basic)MediumContained

Virtual Radiologic Professionals, LLC

bd_c1e800d7d39c4b28 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Oct 15, 2011

Filed

Nov 14, 2011

To disclose

4 weeks

Affected

3state residents only

Confidence

66%

Full breach record for Virtual Radiologic Professionals, LLC →2 incidents on file

Virtual Radiologic Professionals, LLC reported the theft of an unencrypted laptop from an employee's car on Oct 14, 2011. The device contained PHI and PII (SSNs, bank info) for 3 NH residents. Encryption was misconfigured. No evidence of access was found. vRad notified law enforcement, HHS, and affected individuals, providing credit monitoring via LifeLock.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 1 days

discovery → filing · 4 weeks / 30 days

Oct 14, 2011

Begins

Oct 15, 2011

Discovered

Nov 14, 2011

Filed

vs. sector median

5 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed3 affectedView incident

Name: Virtual Radiologic Professionals, LLC
norm: virtual radiologic professionals
Domain: vrad.com

Name: Virtual Radiologic Professionals, LLC
norm: virtual radiologic professionals
Domain: vrad.com
Industry: HealthcarellmTechnologyllm

Discovered: Oct 15, 2011
Breach occurred: Oct 14, 2011
Undetected for: 1 dayoccurrence → discovery
Materiality determined: —
Notification sent: Oct 24, 2011
Affected individuals: 3state-resident count only
Data types: PHIHealth (basic)Government IDFinancial accountIdentity (basic)
Attack vector: Unknown
MITRE ATT&CK: T1052 Exfiltration Over Physical Medium
Threat actor: ExternalFinancial
Regulator citations: Notifying the Department of Health and Human Services

During the incident: Launched an audit of the employee’s email files and local drive
Engaged a third party vendor to assist with this project
Notified local law enforcement
Began notifying affected parties
Contracted with LifeLock, Inc. to provide credit monitoring and alerts
Changes made: Requiring dual sign-off when new laptops are put into service
Deployed IT staff to verify each computer is encrypted properly
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 4 weeks(30 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/virtual-radiologic-20111114.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 14, 2011
Raw hash: f8ec0be9f8e6ed5ee2fa91500e9e5cbf71788577ef238c8d00ab8f62724be6c5

Reporting entityVirtual Radiologic Professionals, LLC

Victim entityVirtual Radiologic Professionals, LLC

Incidentdiscovered Oct 15, 2011

Stated responseLaunched an audit of the employee’s email files and local drive

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov