MisuseHealthcareHealthcarePrivilege AbuseEmployee Data InvolvedCustomer Data InvolvedIdentity (basic)Government IDHealth (basic)Financial accountMediumResolved

Aegis Medical Group

bd_cc91a99a8632305d · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 11, 2019

Filed

Nov 8, 2019

To disclose

8 weeks

Affected

7state residents only

Linked

3 filings

Confidence

66%

Full breach record for Aegis Medical Group →

Aegis Medical Group, LLC notified the NH Attorney General that a former employee inappropriately accessed patient records between July 24 and Sept 9, 2019. The incident involved PHI, SSNs, and financial data for 7 NH residents. The employee was terminated, and 12 months of credit monitoring was offered.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 49 days

discovery → filing · 8 weeks / 58 days

Jul 24, 2019

Begins

Sep 11, 2019

Discovered

Nov 8, 2019

Filed

vs. sector median

3 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_990d99842a332ac32019-11-08Verified
HHS OCRbd_990d14f903b92eda2019-11-07 · +1dVerified

Name: Aegis Medical Group
norm: aegis medical
Domain: aegismedicalgroup.com

Name: Aegis Medical Group
norm: aegis medical
Domain: aegismedicalgroup.com
Industry: Healthcarellm

Discovered: Sep 11, 2019
Breach occurred: Jul 24, 2019 – Sep 9, 2019
Undetected for: 49 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 8, 2019
Affected individuals: 7state-resident count only
Data types: Identity (basic)Government IDHealth (basic)Financial account
Attack vector: Insider
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: InternalFinancial
Regulator citations: provided notice to the Secretary of Health and Human Servicesprovided notice to the three major national credit bureaus
Initial access: insider_action

During the incident: Terminated the employee who inappropriately accessed and misused account records
Made its employees aware of this incident and the consequences to the individual involved
Reminded its employees of the importance of maintaining the security and confidentiality of individual patient account records
Offering, without charge, affected New Hampshire residents credit monitoring and identity theft protection services for a period of twelve (12) months through ID Experts
Changes made: Reviewed its relevant policies and procedures to assess any gaps and areas for improvement
Undertaking a process to convert additional paper records to electronic format, which will allow the Company to better control and restrict access to account records
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(58 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

HHS OCRNov 7 · first

Massachusetts State AG+1d

New Hampshire State AG+1d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/aegis-medical-group-20191108.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 8, 2019
Raw hash: 819dbe81662b7d9207349e044d71dd41a531cf1cdd114ffd70e88ee579fff05e

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityAegis Medical Group

Victim entityAegis Medical Group

Incidentdiscovered Sep 11, 2019

Stated responseTerminated the employee who inappropriately accessed and misused account records

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov