HackingHealthcareHealthcareData ExfiltratedData EncryptedCustomer Data InvolvedIdentity (basic)Government IDHealth (basic)Financial accountHighContained

South Carolina Public Employee Benefit (PEBA)

bd_cb4bad466e36ba94 · schema v1 · pii pii-v1

Severity

High

Discovered

Nov 9, 2021

Filed

Jan 24, 2022

To disclose

11 weeks

Affected

1,006state residents only

Confidence

67%

Full breach record for South Carolina Public Employee Benefit (PEBA) →

Medical Review Institute of America (MRIoA) notified South Carolina Public Employee Benefit (PEBA) of a cyber-attack discovered on November 9, 2021. The incident involved unauthorized access to systems containing protected health information (PHI), including names, SSNs, and medical history. MRIoA engaged forensic experts, contacted the FBI, and confirmed deletion of exfiltrated data. Affected individuals received one year of identity monitoring via Kroll. No evidence of misuse was found at the time of notification.

J jump to incidentP pin to compareR raw source

South Carolina clock✓ SC CRA notice due11 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

discovery → filing · 11 weeks / 76 days

Nov 9, 2021

Discovered

Jan 24, 2022

Filed

vs. sector median

2 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1,006 affectedView incident

Name: Medical Review Institute of America
norm: medical review institute of america
Domain: mrioa.com

Name: South Carolina Public Employee Benefit (PEBA)
norm: south carolina public employee benefit peba
Industry: healthcare
Industry: Healthcarellm

Discovered: Nov 9, 2021
Materiality determined: —
Notification sent: —
Affected individuals: 1,006state-resident count only
Data types: Identity (basic)Government IDHealth (basic)Financial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: ExternalFinancial
Initial access: exploit_public_facing

During the incident: Engaged third-party forensic and incident response experts
Contacted the FBI
Retrieved and confirmed deletion of obtained information
Implemented additional cybersecurity safeguards
Provided one year of complimentary identity monitoring through Kroll
Changes made: Constant monitoring of systems with advanced threat hunting and detection software
Added additional authentication protections
Built new servers to remove threat remnants
Deployed a hardened and new backup environment
Enhanced employee cybersecurity training
Reviewed, revised, and amended cybersecurity policies
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 11 weeks(76 days from discovery to filing)
Compliance flags: SC CRA notice due
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/PEBA.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 24, 2022
Raw hash: 17ba348b8239a03f434711b67a9c1af5a13932b2d0d55c1dc6cbc9927eada351

Reporting entityMedical Review Institute of America

Victim entitySouth Carolina Public Employee Benefit (PEBA)

Incidentdiscovered Nov 9, 2021

Stated responseEngaged third-party forensic and incident response experts

ComplianceSC CRA notice due

Extraction provenanceno artifact recorded

Source provenanceconsumer.sc.gov