PhysicalHealthcareProfessional ServicesHealthcareTheftCustomer Data InvolvedData ExfiltratedIdentity (basic)Government IDHealth (basic)Financial accountHighContained

Indiana State Medical Association

bd_c5ca7ff1ad265c5c · schema v1 · pii pii-v1

Severity

High

Discovered

Feb 13, 2015

Filed

Mar 6, 2015

To disclose

21 days

Affected · nationwide

39,0905 in this filing

Linked

2 filings

Confidence

66%

Full breach record for Indiana State Medical Association →

Indiana State Medical Association (ISMA) reported the theft of two unencrypted archive hard drives containing personal information of 39,090 individuals. The theft occurred on February 13, 2015, while an employee was transporting the drives to an off-site storage location. Affected data included names, addresses, dates of birth, email addresses, health plan numbers, and for some individuals, social security numbers and medical history. ISMA discovered the theft the same day and reported it to police. Encryption had been disabled by an IT vendor without ISMA's knowledge. ISMA restored encryption, revised policies, and offered one year of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 21 days

Feb 13, 2015

Begins

Feb 13, 2015

Discovered

Mar 6, 2015

Filed

vs. sector median

9 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

HHS OCRbd_18cc36fe26d14b832015-03-06Candidate

Name: Indiana State Medical Association
norm: indiana state medical association
Domain: www.ismanet.org

Name: Indiana State Medical Association
norm: indiana state medical
Domain: www.ismanet.org
Industry: HealthcarellmProfessional Servicesllm

Discovered: Feb 13, 2015
Breach occurred: Feb 13, 2015
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 6, 2015
Affected individuals: 39,090state + nationwide
Data types: Identity (basic)Government IDHealth (basic)Financial account
Data elements: Social Security numberDate of birthMedical information
Attack vector: Unknown
MITRE ATT&CK: T1052 Exfiltration Over Physical Medium
Threat actor: External
Regulator citations: Notified the New Hampshire Attorney GeneralReported to the Indianapolis Metropolitan Police Department
Third party: via Information technology vendor

During the incident: Reported the theft to the Indianapolis Metropolitan Police Department
Restored encryption on archive drives
Revised internal policies and procedures
Provided education to employees
Offered one year of credit monitoring and credit repair services through ID Experts
Engaged outside experts to evaluate internal processes
Changes made: Restored encryption on archive drives
Revised internal policies and procedures
Provided education to employees
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 21 days(21 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

HHS OCRMar 6 · first

New Hampshire State AGMar 6 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/indiana-state-medical-20150306.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 6, 2015
Raw hash: a42008911da507bc8ac6f39e93fd857cb01ba8f79a0460edbb2187047546be7d

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityIndiana State Medical Association

Victim entityIndiana State Medical Association

Incidentdiscovered Feb 13, 2015

Stated responseReported the theft to the Indianapolis Metropolitan Police Department

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov