Social EngineeringHealthcareRetail & ConsumerHealthcarePhishingStolen CredentialsCustomer Data InvolvedEmployee Data InvolvedData ExfiltratedIdentity (basic)Government IDFinancial accountHealth (basic)CredentialsMinorMediumContained

Reliable Respiratory

bd_c3987bb4b54a02a0 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 3, 2018

Filed

Oct 29, 2018

To disclose

17 weeks

Affected

6state residents only

Linked

4 filings

Confidence

66%

Full breach record for Reliable Respiratory →

Reliable Respiratory notified regulators of a phishing incident where an employee's email credentials were compromised. Unauthorized access occurred June 28-July 2, 2018. Data exposed included names, SSNs, driver's licenses, bank accounts, and PHI. 880 individuals affected nationwide (6 in NH). Notification mailed October 23, 2018. Credit monitoring offered.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 5 days

discovery → filing · 17 weeks / 118 days

Jun 28, 2018

Begins

Jul 3, 2018

Discovered

Oct 29, 2018

Filed

vs. sector median

+6 wks slower

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Massachusetts State AGbd_15428dd70672ee5d2018-10-23 · +6dVerified
Montana State AGbd_28a6e8acbcd217312018-10-23 · +6dVerified
HHS OCRbd_e5709ee6a4d927082018-09-01 · +58dVerified

Name: Reliable Respiratory
norm: reliable respiratory

Name: Reliable Respiratory
norm: reliable respiratory
Industry: HealthcarellmRetail & Consumerllm

Discovered: Jul 3, 2018
Breach occurred: Jun 28, 2018 – Jul 2, 2018
Undetected for: 5 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 23, 2018
Affected individuals: 6state-resident count only
Data types: Identity (basic)Government IDFinancial accountHealth (basic)CredentialsMinor
Data elements: Social Security numberDate of birthMedical information
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Regulator citations: Providing notice to the U.S. Department of Health and Human ServicesProviding notice to required state regulators
Initial access: phishing_link

During the incident: Changed the affected user's email credentials
Engaged third party forensic investigators
Posted notice of this incident on its website
Issued notice of this incident to statewide media in New Hampshire
Began mailing written notice of this incident to potentially affected individuals
Providing potentially impacted individuals with access to credit monitoring and identity theft protection services for one (1) year through Kroll
Changes made: Implementing additional safeguards to protect the security of information
Reviewing policies and procedures in order to protect the security of information on its systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 17 weeks(118 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 3 states

View merged incident ↗

HHS OCRSep 1 · first

Massachusetts State AG+52d

Montana State AG+52d

New Hampshire State AG+58d · this page

Pattern: first filing Sep 1 (MA), last Oct 29 (NH) — a 58-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/reliable-respiratory-20181029.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 29, 2018
Raw hash: 150d6cc4c2fd4454bfe3ddf09a5ffce3cfdaa93456b5a107fb2627dd44b238f6

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityReliable Respiratory

Victim entityReliable Respiratory

Incidentdiscovered Jul 3, 2018

Stated responseChanged the affected user's email credentials

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov