Social EngineeringHealthcareHealthcarePhishingData ExfiltratedCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDHealth (basic)Financial accountMediumContained

MEDNAX Services, Inc.

bd_c82e812b30165e94 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 16, 2020

Filed

Jan 12, 2021

To disclose

26 weeks

Affected

109state residents only

Linked

8 filings

Confidence

65%

Full breach record for MEDNAX Services, Inc. →2 incidents on file

North American Partners in Anesthesia (NAPA) notified the New Hampshire Attorney General of a security incident involving its business associate, MEDNAX Services, Inc. An unauthorized party accessed MEDNAX's Microsoft Office 365 email system between June 17 and June 22, 2020, via phishing. The attacker attempted payroll fraud but was unsuccessful. Patient and guarantor information (names, SSNs, health insurance details, medical records) was stored in compromised accounts. 109 New Hampshire residents were affected. NAPA offered one year of credit monitoring. The incident was contained by resetting passwords and adding authentication requirements.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 29 days

discovery → filing · 26 weeks / 180 days

Jun 17, 2020

Begins

Jul 16, 2020

Discovered

Jan 12, 2021

Filed

vs. sector median

+13 wks slower

This filing is one of 8 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (7) · sorted by filing gap

Massachusetts State AGbd_0556c2fd8b6abc362020-12-23 · +20dVerified
California State AGbd_11476f6352fa26262020-12-23 · +20dCandidate
California State AGbd_1253ca6eeacfa8792020-12-16 · +27dCandidate
HHS OCRbd_2317d15fb2fdc5372020-12-16 · +27dCandidate

Show 3 more filings ↓up to 27d gap

Montana State AGbd_3c1d1683a865d9562020-12-16 · +27dVerified
Oregon State AGbd_cc27b0970ea647262020-12-16 · +27dVerified
Washington State AGbd_ef1f98abb4d60c8e2020-12-16 · +27dVerified

Name: North American Partners in Anesthesia
norm: north american partners in anesthesia

Name: MEDNAX Services, Inc.
norm: mednax services
Industry: Healthcarellm

Discovered: Jul 16, 2020
Breach occurred: Jun 17, 2020 – Jun 22, 2020
Undetected for: 29 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 109state-resident count only
Data types: Identity (basic)Government IDHealth (basic)Financial account
Data elements: Social Security numberDate of birth
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing Link
Threat actor: ExternalFinancial
Regulator citations: Reported to the U.S. Department of Health and Human Services pursuant to 45 CFR §164.408
Initial access: phishing_link

During the incident: Terminated the unauthorized party's access to the 0365 System
Resetting each user's password for the email accounts where unauthorized activity was detected
Moved email accounts on the 0365 system used by American Anesthesiology employees to our email system
Added authentication requirements to restrict access to the email accounts of these American Anesthesiology employees
Introducing additional authentication and security training requirements for all of our employees in 2021 to counteract phishing and other social engineering techniques
Offered one year of credit monitoring to those individuals whose social security number was available within the compromised email accounts
Changes made: Introducing additional authentication and security training requirements for all of our employees in 2021 to counteract phishing and other social engineering techniques
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 26 weeks(180 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 7 states

View merged incident ↗

California State AGDec 16 · first

HHS OCRDec 16 · first

Montana State AGDec 16 · first

Oregon State AGDec 16 · first

Washington State AGDec 16 · first

Massachusetts State AG+7d

California State AG+7d

New Hampshire State AG+27d · this page

Pattern: first filing Dec 16 (CA), last Jan 12 (NH) — a 27-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/mednax-services-20210112.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 12, 2021
Raw hash: 380f93dd077495432b48ee54eb4c1c52f352e7f04afdc67f87053c8614607bc0

Linked disclosures

Regulatory filings (7) · sorted by filing gap

Reporting entityNorth American Partners in Anesthesia

Victim entityMEDNAX Services, Inc.

Incidentdiscovered Jul 16, 2020

Stated responseTerminated the unauthorized party's access to the 0365 System

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov