MalwareHealthcareHealthcareRansomwareData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDHealth (basic)PHIMediumContained

Central Indiana Orthopedics

bd_dfcca2999372f5fd · schema v1 · pii pii-v1

Severity

Medium

Discovered

Oct 16, 2021

Filed

Mar 14, 2022

To disclose

21 weeks

Affected

6state residents only

Linked

5 filings

Confidence

67%

Full breach record for Central Indiana Orthopedics →

Central Indiana Orthopedics notified the NH AG of a ransomware incident discovered on Oct 16, 2021. The attack compromised patient and employee PII (names, addresses, SSNs) and limited health information. 6 NH residents were notified on March 7, 2022. CIO engaged forensic investigators, restored systems from backup, and offered 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 21 weeks / 149 days

Oct 16, 2021

Discovered

Mar 14, 2022

Filed

vs. sector median

+9 wks slower

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Maine State AGbd_550eb4f72b1e5e472022-03-07 · +7dCandidate
Indiana State AGbd_8786bc3229e906422022-03-07 · +7dVerified
HHS OCRbd_9d937bc08a111f472022-03-07 · +7dVerified
Montana State AGbd_e8b63382f007b5252022-03-07 · +7dCandidate

Name: Wilson, Elser, Moskowitz, Edelman & Dicker LLP
norm: wilson elser moskowitz edelman dicker
Domain: wilsonelser.com

Name: Central Indiana Orthopedics
norm: central indiana orthopedics
Industry: Healthcarellm

Discovered: Oct 16, 2021
Materiality determined: —
Notification sent: Mar 7, 2022
Affected individuals: 6state-resident count only
Data types: Identity (basic)Government IDHealth (basic)PHI
Data elements: Social Security number
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney General John Formella

During the incident: Engaged a specialized cybersecurity firm to conduct a forensic investigation
Restored systems from a viable backup
Engaged a specialized third-party cybersecurity firm to assist with securing the environment
Changed administrative credentials
Restored operations in a safe and secure mode
Offered twelve (12) months of complimentary credit monitoring, identity theft restoration, and dark web monitoring services through IDX
Changes made: Issuing a company-wide password reset
Enhancing their firewall protections
Implementing new procedures for data retention to limit accessible historical data
Upgrading intrusion prevention systems through FortiNet Cloud services
Improving vulnerability testing and patching
Implementing a KnowBe4 program for employee training
Replacing existing mail filtering system with FortiMail Sandbox subscription
Selecting a third party provider of encryption and network monitoring services
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 21 weeks(149 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 4 states

View merged incident ↗

Maine State AGMar 7 · first

Indiana State AGMar 7 · first

HHS OCRMar 7 · first

Montana State AGMar 7 · first

New Hampshire State AG+7d · this page

Pattern: first filing Mar 7 (ME), last Mar 14 (NH) — a 7-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/central-indiana-orthopedics-20220314.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 14, 2022
Raw hash: 0cad7ded95cec22f230234868abf959b4b7c57db980fe1922f1408e4327e0f5c

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityWilson, Elser, Moskowitz, Edelman & Dicker LLP

Victim entityCentral Indiana Orthopedics

Incidentdiscovered Oct 16, 2021

Stated responseEngaged a specialized cybersecurity firm to conduct a forensic investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov