HackingHealthcareHealthcareCapture Stored DataSupply Chain (3P Vendor)Business Associate (HIPAA)Customer Data InvolvedData ExfiltratedDelayed DiscoveryPHIPIIIdentity (basic)Government IDHealth (basic)Financial accountMediumContained

Primary Anesthesia Services

bd_da3faa19aeea6d49 · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Oct 25, 2022

To disclose

—

Affected

Not disclosed

Linked

2 filings

Confidence

71%

Full breach record for Primary Anesthesia Services →

Primary Anesthesia Services notified patients of a data breach originating at its third-party management company. On July 11, 2022, the management company identified suspicious activity on its systems, disconnected all systems, and engaged cybersecurity experts. The breach potentially exposed PHI including names, SSNs, dates of birth, driver's license numbers, financial account info, health insurance policy numbers, and health treatment/diagnosis data. Notification letters were sent October 24, 2022.

J jump to incidentP pin to compareR raw source

Incident timeline

Jul 9, 2022

Begins

Oct 25, 2022

Filed

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

HHS OCRbd_1bb09afb009fd8ee2022-10-24 · +1dVerified

Name: Primary Anesthesia Services
norm: primary anesthesia

Name: Primary Anesthesia Services
norm: primary anesthesia
Industry: Healthcarellm

Discovered: —
Breach occurred: Jul 9, 2022 – Jul 11, 2022
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: PHIPIIIdentity (basic)Government IDHealth (basic)Financial account
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1119 Automated Collection
Threat actor: External

During the incident: The management company immediately implemented its incident response protocols
Disconnected all systems
Engaged external cybersecurity experts to conduct a forensic investigation
Reviewed the potentially impacted information to identify any protected health information that may have been affected
Offering identity theft protection services through IDX, the data breach and recovery services expert
Changes made: Conducting a global password reset
Tightening firewall restrictions
Implementing endpoint threat detection and response monitoring software on workstations and servers
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

HHS OCROct 24 · first

California State AG+1d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-558565
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 25, 2022
Raw hash: 9d3e5a47b4d0d2c8ac2a815cdc65aa8563ea19e6ca44228f8769c46cf8eb81b5

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityPrimary Anesthesia Services

Victim entityPrimary Anesthesia Services

IncidentThird-Party / Supply Chain

Stated responseThe management company immediately implemented its incident response protocols

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov