MalwareHealthcareTechnologyHealthcareRansomwareCapture Stored DataData ExfiltratedData EncryptedCustomer Data InvolvedEmployee Data InvolvedPHIHealth (basic)Identity (basic)MinorMediumContained

Timberline Billing Service, LLC

bd_e5383d8093c67e7c · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 5, 2020

Filed

Oct 20, 2020

To disclose

33 weeks

Affected

1state residents only

Linked

2 filings

Confidence

65%

Full breach record for Timberline Billing Service, LLC →2 incidents on file

Timberline Billing Service, LLC notified affected individuals of a ransomware incident where an unknown actor encrypted files and exfiltrated data between Feb 12 and Mar 4, 2020. Timberline discovered the activity on Mar 5, 2020. Compromised data included PHI and PII of minors. Timberline engaged forensic specialists, reported to law enforcement, upgraded security infrastructure, and offered 12 months of identity monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 22 days

discovery → filing · 33 weeks / 229 days

Feb 12, 2020

Begins

Mar 5, 2020

Discovered

Oct 20, 2020

Filed

vs. sector median

+22 wks slower

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

HHS OCRbd_188fb999412890cd2020-10-30 · +10dVerified

Name: Timberline Billing Service, LLC
norm: timberline billing service

Name: Timberline Billing Service, LLC
norm: timberline billing service
Industry: HealthcarellmTechnologyllm

Discovered: Mar 5, 2020
Breach occurred: Feb 12, 2020 – Mar 4, 2020
Undetected for: 22 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 20, 2020
Affected individuals: 1state-resident count only
Data types: PHIHealth (basic)Identity (basic)Minor
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Reporting this incident to certain regulatory authorities

During the incident: Launched an investigation to determine the nature and scope of this activity
Working with outside computer forensic specialists
Undertook a comprehensive and time-intensive review of all files that could have been impacted
Reported this incident to law enforcement
Reporting this incident to certain regulatory authorities
Offering your minor dependent access to 12 months of minor identity monitoring through Experian at no cost
Changes made: Upgrading all servers and firewalls
Resettin g all user passwords and requiring frequent password rotations
Migrating school and student data to a cloud location
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 33 weeks(229 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Montana State AGOct 20 · first · this page

HHS OCR+10d

Pattern: first filing Oct 20 (MT), last Oct 30 (IA) — a 10-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/timberSamp.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 20, 2020
Raw hash: 6addd765c8c14a18c5131310680442d41bda802ebfe5262392f71568bb1bc1db

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityTimberline Billing Service, LLC

Victim entityTimberline Billing Service, LLC

Incidentdiscovered Mar 5, 2020

Stated responseLaunched an investigation to determine the nature and scope of this activity

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov