MalwareHealthcareHealthcareRansomwareSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDHealth (basic)PHIHighContained

Osborn Cancer Care

bd_d738e5cc363dcd7c · schema v1 · pii pii-v1

Severity

High

Discovered

Feb 17, 2021

Filed

May 28, 2021

To disclose

14 weeks

Affected

4,305state residents only

Linked

3 filings

Confidence

68%

Full breach record for Osborn Cancer Care →3 incidents on file

Osborn Cancer Care notified Washington AG of a Feb 2021 cyberattack affecting 4,305 residents. The breach originated from third-party EMR provider GeniusDoc, Inc., which was infiltrated on Feb 10, 2021. Compromised data included names, addresses, driver's licenses, DOBs, and medical info. OCC engaged forensic specialists, notified HHS, and offered credit monitoring.

J jump to incidentP pin to compareR raw source

Washington clock✗ WA AG >90d14 weeks discovery → filing

Incident timeline

undetected · 7 days

discovery → filing · 14 weeks / 100 days

Feb 10, 2021

Begins

Feb 17, 2021

Discovered

May 28, 2021

Filed

vs. sector median

+5 wks slower

This filing is one of 3 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Indiana State AGbd_2c7215156bbd24592021-07-26 · +59dVerified
Montana State AGbd_983c42c9031e72422021-07-26 · +59dVerified

Name: Wilson Elser Moskowitz Edelman & Dicker LLP
norm: wilson elser moskowitz edelman dicker
Domain: osborn-eng.com

Name: Osborn Cancer Care
norm: osborn cancer care
Industry: Healthcarellm

Discovered: Feb 17, 2021
Breach occurred: Feb 10, 2021
Undetected for: 7 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 26, 2021
Affected individuals: 4,305state-resident count only
Data types: Identity (basic)Government IDHealth (basic)PHI
Data elements: NameDriver's licence numberDate of birthMedical information
WA-stated cause: Cyberattack
WA-stated duration: lifecycle Unknowndexposure Unknownd
WA-stated discovery: Found after the fact
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain CompromiseT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified the Department of Health and Human Services on June 8, 2021
Third party: via GeniusDoc, Inc.
Initial access: supply_chain

During the incident: Conducted an investigation with the assistance of third-party forensic specialists
Confirmed the security of their network environment
Reviewed and altered their tools, policies, and procedures relating to the security of their systems and servers
Reviewed and altered their information life cycle management
Notified the Department of Health and Human Services
Offering credit monitoring and identity theft protection services to through IDX
Changes made: Transitioning to a new EMR vendor
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 14 weeks(100 days from discovery to filing)
Compliance flags: WA AG >90d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Washington State AGMay 28 · first · this page

Indiana State AG+59d

Montana State AG+59d

Pattern: first filing May 28 (WA), last Jul 26 (MT) — a 59-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10703.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 28, 2021
Raw hash: cd5fd613ff65e97120e0b95ad03a31ba3a7bdaa0af6b2829d704fba761c04cbb

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityWilson Elser Moskowitz Edelman & Dicker LLP

Victim entityOsborn Cancer Care

Incidentdiscovered Feb 17, 2021

Stated responseConducted an investigation with the assistance of third-party forensic specialists

ComplianceWA AG >90d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com