HackingHealthcareHealthcareVulnerability ExploitTargetedData ExfiltratedIdentity (basic)Government IDPHIHealth (basic)CriticalContained

Consulting Radiologists

bd_daa30c9ef32cdbca · schema v1 · pii pii-v1

Severity

Critical

Discovered

Feb 12, 2024

Filed

Aug 27, 2024

To disclose

28 weeks

Affected · nationwide

580,70361 in this filing

Linked

14 records

Confidence

66%

Full breach record for Consulting Radiologists →

Consulting Radiologists LTD. (CRL), a radiology practice, disclosed an external system breach (hacking) on February 12, 2024. The incident affected 580,703 individuals, including 61 Maine residents. Compromised data included names, addresses, dates of birth, SSNs, and medical/insurance information. CRL engaged forensic investigators, deployed monitoring tools, and offered 12 months of credit monitoring and identity protection services to affected individuals.

J jump to incidentP pin to compareR raw source

Maine clockScope identified Apr 17, 2024 → Filed with AG Aug 27, 2024132d ✗ ME AG >90d28 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 28 weeks / 197 days

Feb 12, 2024

Begins

Feb 12, 2024

Discovered

Aug 27, 2024

Filed

vs. sector median

+19 wks slower

This filing is one of 14 records about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

California State AGbd_50ea62962f6053f12024-08-27Verified by operator
New Hampshire State AGbd_e1f9d17e915d51d42024-07-22 · +36dVerified by operator
Vermont State AGbd_8996de206fe6cdd52024-07-16 · +42dVerified by operator
New Hampshire State AGbd_c2b65bb4577a64172024-06-18 · +70dVerified by operator

Show 6 more filings ↓up to 74d gap

Montana State AGbd_2e90566000a585002024-06-14 · +74dVerified by operator
California State AGbd_65730f74869a357a2024-06-14 · +74dVerified by operator
Massachusetts State AGbd_a8a23b8b48b32fd52024-06-14 · +74dVerified by operator
HHS OCRbd_c3bdfc4c8390e5cf2024-06-14 · +74dVerified by operator
Maine State AGbd_ce63da405a317bbf2024-06-14 · +74dVerified by operator
Indiana State AGbd_eb428a7c019b32512024-06-14 · +74dVerified

Showing first 10 of 13 linked disclosures.

Name: Wilson, Elser, Moskowitz, Edelman & Dicker LLP
norm: wilson elser moskowitz edelman dicker
Domain: wilsonelser.com

Name: Consulting Radiologists
norm: consulting radiologists
Domain: consultingradiologists.com
Industry: Healthcarellm

Discovered: Feb 12, 2024
Scope identified: Apr 17, 2024Maine’s notice clock starts here (10 M.R.S. §1348(1))The letter says: “On April 17, 2024, CRL identified persons whose sensitive data was included within the impacted data.”
Breach occurred: Feb 12, 2024
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 27, 2024
Affected individuals: 580,703state + nationwide
Data types: Identity (basic)Government IDPHIHealth (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: External
Initial access: exploit_public_facing

During the incident: Engaged a specialized cybersecurity firm to investigate the nature and scope of the incident
Moved quickly to initiate an investigation
Retained a leading forensic investigation firm who assisted in conducting an investigation and confirming the security of our network environment
Deployed additional monitoring tools
Changes made: Will continue to enhance the security of our systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 28 weeks(197 days from discovery to filing)
Compliance flags: ME AG >90d · 132dME resident >60d · 132d
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Scope identified: Apr 17, 2024
→ Filed with AG: Aug 27, 2024
132d 90 days from scope identification ME AG >90d
Maine
Scope identified: Apr 17, 2024
→ Notified: Aug 27, 2024
132d 60 days (analyst band; statutory cap is 30 days) ME resident >60d

Statute	Window	Elapsed	Threshold	Status
Maine	Scope identified: Apr 17, 2024 → Filed with AG: Aug 27, 2024	132d	90 days from scope identification	ME AG >90d
Maine	Scope identified: Apr 17, 2024 → Notified: Aug 27, 2024	132d	60 days (analyst band; statutory cap is 30 days)	ME resident >60d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 8 states

View merged incident ↗

Montana State AGJun 14 · first

California State AGJun 14 · first

Massachusetts State AGJun 14 · first

HHS OCRJun 14 · first

Maine State AGJun 14 · first

Indiana State AGJun 14 · first

New Hampshire State AG+4d

Vermont State AG+32d

New Hampshire State AG+38d

California State AG+74d

Maine State AG+74d · this page

Pattern: first filing Jun 14 (MT), last Aug 27 (ME) — a 74-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Cascade drawn from the first 10 linked disclosures of 13 — the full spread may be wider.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/d0ef13ca-8d44-4cf2-abca-1d483fbbbddf.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 27, 2024
Raw hash: 667a4b22537731ef24371386007c9081edd664e91774092623668ed085721270

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entityWilson, Elser, Moskowitz, Edelman & Dicker LLP

Victim entityConsulting Radiologists

Incidentdiscovered Feb 12, 2024

Stated responseEngaged a specialized cybersecurity firm to investigate the nature and scope of the incident

ComplianceME AG >90d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov