MultipleHealthcareHealthcareVulnerability ExploitRansomwareData MishandlingSupply Chain (3P Vendor)Data EncryptedCustomer Data InvolvedBusiness Associate (HIPAA)PHIHealth (basic)Identity (basic)Financial accountLowContained

Spectrum Eye Physicians

bd_cb60c64bcfde2afc · schema v1 · pii pii-v1

Severity

Low

Discovered

May 19, 2022

Filed

Jul 11, 2022

To disclose

8 weeks

Affected

Not disclosed

Confidence

66%

Full breach record for Spectrum Eye Physicians →2 incidents on file

Spectrum Eye Physicians notified patients of two data breaches involving third-party vendor Eye Care Leaders (ECL). The first involved a vulnerability in the Alta Payment Portal allowing unauthorized access to payment receipts (Oct 2021). The second was a ransomware attack on ECL's myCare Integrity EMR system (Dec 2021) where attackers deleted databases. Spectrum discovered the issues in May 2022. Affected data includes PHI, financial account details, and patient identities. Spectrum terminated contracts with ECL and migrated to new vendors.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 205 days

discovery → filing · 8 weeks / 53 days

Oct 26, 2021

Begins

May 19, 2022

Discovered

Jul 11, 2022

Filed

vs. sector median

3 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: Spectrum Eye Physicians
norm: spectrum eye physicians
Domain: spectrumeye.com

Name: Spectrum Eye Physicians
norm: spectrum eye physicians
Domain: spectrumeye.com
Industry: Healthcarellm

Discovered: May 19, 2022
Breach occurred: Oct 26, 2021 – Dec 4, 2021
Undetected for: 205 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: PHIHealth (basic)Identity (basic)Financial account
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1486 Data Encrypted for ImpactT1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Regulator citations: Filing a Breach Report with the Office for Civil Rights (OCR)
Third party: via Eye Care Leaders
Initial access: exploit_public_facing

During the incident: Retained an incident response team to investigate and remedy the vulnerability
Took the Alta Payment Portal system offline to prevent further potential unauthorized access
Provided individual notice to all of its patients whose PHI may have been maintained in the Alta Payment Portal
Notifying the local media (via press release) of the potential data breach
Filing a Breach Report with the Office for Civil Rights (OCR)
Communicating with its legal counsel to determine what, if any, recourse it has against Alta and ECL
Terminated its Alta billing services contract and transfer its patient billing records to another billing vendor
Provided notice to all of its patients whose PHI was maintained in the Integrity EMR
Notifying the local media (via press release) of the data breach
Filing a Breach Report with OCR
Communicating with its legal counsel to determine what, if any, recourse it has against ECL
Terminated its Integrity EMR contract with ECL and transfer its patient PHI to another EMR vendor
Disabled the attack instance
Revoked access to the attack instance
Forced system password changes
Updated and changed several additional security features within the environment
Began efforts to restore deleted files and databases from backups
Changes made: Terminated its Alta billing services contract and transfer its patient billing records to another billing vendor
Terminated its Integrity EMR contract with ECL and transfer its patient PHI to another EMR vendor
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(53 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-555119
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 11, 2022
Raw hash: 76176b15e957ec9c408016cad79d27a7d693317f02c4093f7bf3e5d3ead09e6c

Reporting entitySpectrum Eye Physicians

Victim entitySpectrum Eye Physicians

Incidentdiscovered May 19, 2022

Stated responseRetained an incident response team to investigate and remedy the vulnerability

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov