DisclosureLens
HackingHealthcareHealthcareCustomer Data InvolvedIdentity (basic)Financial accountFinancial credentialsHigh

Orthopedic Associates of Dutchess County

bd_cdc2f8515bcf355b · schema v1 · pii pii-v1

Severity

High

Discovered

Mar 5, 2021

Filed

May 4, 2021

To disclose

9 weeks

Affected · nationwide

331,37691 in this filing

Linked

4 filings

Confidence

50%
Full breach record for Orthopedic Associates of Dutchess County →

Orthopedic Associates of Dutchess County, a healthcare organization, reported an external system breach (hacking) that occurred on March 1, 2021, and was discovered on March 5, 2021. The breach affected 91 Maine residents. The compromised information included names or other personal identifiers in combination with financial account numbers or credit/debit card numbers along with their security codes, access codes, passwords, or PINs. The organization provided written notification to the affected individuals on May 4, 2021, and offered 12 months of identity and credit monitoring services through Experian.

Maine clockDiscovered Mar 5, 2021 → Filed with AG May 4, 202160d ⏱ ME AG >30d9 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 4 days
discovery → filing · 9 weeks / 60 days

Mar 1, 2021

Begins

Mar 5, 2021

Discovered

May 4, 2021

Filed

vs. sector median

4 wks faster

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Filing propagation · 4 filings · 4 states

View merged incident ↗
HHS OCRMay 4 · first
Massachusetts State AGMay 4 · first
Maine State AGMay 4 · first · this page
New Hampshire State AG+6d

Pattern: first filing May 4 (NY), last May 10 (NH) — a 6-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.