HackingHealthcareHealthcareCustomer Data InvolvedPIIPHIIdentity (basic)Health (basic)LowContained

Cardiothoracic and Vascular Surgeons, P.A.

bd_e31f0e2bdff2c094 · schema v1 · pii pii-v1

Severity

Low

Discovered

Oct 13, 2023

Filed

Feb 16, 2024

To disclose

18 weeks

Affected

2state residents only

Linked

3 filings

Confidence

65%

Full breach record for Cardiothoracic and Vascular Surgeons, P.A. →2 incidents on file

Cardiothoracic and Vascular Surgeons, P.A. (CTVS) notified New Hampshire residents of a security incident where unauthorized access occurred between Oct 12-13, 2023. CTVS discovered suspicious activity on Oct 13, 2023. Patient PII/PHI was accessed. CTVS notified law enforcement and HHS, offered credit monitoring, and reviewed security policies.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 1 days

discovery → filing · 18 weeks / 126 days

Oct 12, 2023

Begins

Oct 13, 2023

Discovered

Jan 22, 2024

Scope determined

Feb 16, 2024

Filed

vs. sector median

+6 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Maine State AGbd_3246286846efbc422024-02-16Candidate
Illinois State AGbd_99ae5ca15c8556d02024-02-01 · +15dVerified

Name: Cardiothoracic and Vascular Surgeons, P.A.
norm: cardiothoracic and vascular surgeons
Domain: ctvstexas.com

Name: Cardiothoracic and Vascular Surgeons, P.A.
norm: cardiothoracic and vascular surgeons
Domain: ctvstexas.com
Industry: Healthcarellm

Discovered: Oct 13, 2023
Breach occurred: Oct 12, 2023 – Oct 13, 2023
Undetected for: 1 dayoccurrence → discovery
Materiality determined: Jan 22, 2024
Notification sent: Feb 16, 2024
Affected individuals: 2state-resident count only
Data types: PIIPHIIdentity (basic)Health (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: External
Regulator citations: CTVS notified the U.S. Department of Health and Human Services

During the incident: CTVS moved quickly to investigate and respond
Assess the security of CTVS systems
Identify potentially affected individuals
CTVS notified federal law enforcement regarding the event
Working to implement additional safeguards and training to its employees
Providing access to credit monitoring services for through TransUnion
Providing impacted individuals with guidance on how to better protect against identity theft and fraud
Providing individuals with information on how to place a fraud alert and security freeze on one’s credit file
Contact details for the national consumer reporting agencies
Information on how to obtain a free credit report
Reminder to remain vigilant for incidents of fraud and identity theft by reviewing account statements and monitoring free credit reports
Encouragement to contact the Federal Trade Commission, their state Attorney General, and law enforcement to report attempted or actual identity theft and fraud
Providing written notice of this incident to relevant state and federal regulators
CTVS notified the U.S. Department of Health and Human Services
Posted notification on its website
Changes made: Reviewing our policies, procedures, and processes related to the storage and access of sensitive information to reduce the likelihood of a similar future incident
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 18 weeks(126 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Illinois State AGFeb 1 · first

Maine State AG+15d

New Hampshire State AG+15d · this page

Pattern: first filing Feb 1 (IL), last Feb 16 (NH) — a 15-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/cardiothoracic-vascular-surgeons-20240216.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 16, 2024
Raw hash: 7192454bbcd29a9976fd9504046d31923c1cdeba4a0bd6a06181e3c1f4fa524f

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityCardiothoracic and Vascular Surgeons, P.A.

Victim entityCardiothoracic and Vascular Surgeons, P.A.

Incidentdiscovered Oct 13, 2023

Stated responseCTVS moved quickly to investigate and respond

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov