MalwareHealthcareHealthcareRansomwareRansom DemandedData EncryptedCustomer Data InvolvedIdentity (basic)Government IDHealth (basic)PHIMediumContained

The SurgiCare Center of Utah

bd_d5370fd792e6263f · schema v1 · pii pii-v1

Severity

Medium

Discovered

Dec 21, 2020

Filed

Mar 19, 2021

To disclose

13 weeks

Affected

188state residents only

Linked

4 filings

Confidence

66%

Full breach record for The SurgiCare Center of Utah →2 incidents on file

The SurgiCare Center of Utah notified the Idaho AG of a ransomware attack detected on Dec 21, 2020. 188 Idaho residents affected. Data exposed: names, addresses, SSNs, DOBs, PHI. SCU engaged IT specialists, worked with law enforcement, and offered 12 months of Kroll credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 13 weeks / 88 days

Dec 21, 2020

Begins

Dec 21, 2020

Discovered

Mar 19, 2021

Filed

vs. sector median

+2 wks slower

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

New Hampshire State AGbd_a6342d44227a3a112021-03-19Verified
Montana State AGbd_12dbf2ca3826eb272021-03-16 · +3dCandidate
Indiana State AGbd_6a37dff598c302672021-03-16 · +3dVerified

Name: The SurgiCare Center of Utah
norm: the surgicare center of utah

Name: The SurgiCare Center of Utah
norm: the surgicare center of utah
Industry: Healthcarellm

Discovered: Dec 21, 2020
Breach occurred: Dec 21, 2020
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 16, 2021
Affected individuals: 188state-resident count only
Data types: Identity (basic)Government IDHealth (basic)PHI
Data elements: Social Security numberDate of birthMedical information
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1190 Exploit Public-Facing Application
Threat actor: ExternalFinancial
Regulator citations: Notified Idaho Attorney General
Initial access: exploit_public_facing

During the incident: Conducting an investigation with the assistance of IT specialists
Confirming the security of its network environment
Working with law enforcement in response to this incident
Offering free identity monitoring services through Kroll
Changes made: Reviewed and altered its policies and procedures relating to the security of its systems and servers
Reviewed and altered its information life cycle management
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 13 weeks(88 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Montana State AGMar 16 · first

Indiana State AGMar 16 · first

New Hampshire State AG+3d

Idaho State AG+3d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ag.idaho.gov/content/uploads/2022/03/03-19-21-The-SurgiCare-Center-of-Utah.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 19, 2021
Raw hash: 57f2b57b775d967af35c86360b1889e2764ea7ee3b4d6027db9b219bf8dae37e

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityThe SurgiCare Center of Utah

Victim entityThe SurgiCare Center of Utah

Incidentdiscovered Dec 21, 2020

Stated responseConducting an investigation with the assistance of IT specialists

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceag.idaho.gov