HackingHealthcareHealthcareDelayed DiscoveryHealth (basic)Identity (basic)Government IDMinorPHIMediumContained

Valley Anesthesiology Consultants, Inc.

bd_e78919fc3bf14808 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 13, 2016

Filed

Aug 12, 2016

To disclose

9 weeks

Affected

611state residents only

Linked

6 filings

Confidence

71%

Full breach record for Valley Anesthesiology Consultants, Inc. →

Valley Anesthesiology Consultants, Inc. notified the Washington AG that a third party may have gained unauthorized access to its computer systems on March 30, 2016. The company discovered the incident on June 13, 2016. Patient data, including names, SSNs, and medical codes, was potentially exposed. 611 Washington residents were notified on August 12, 2016.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 75 days

discovery → filing · 9 weeks / 60 days

Mar 30, 2016

Begins

Jun 13, 2016

Discovered

Aug 12, 2016

Filed

vs. sector median

2 wks faster

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Oregon State AGbd_528c463d467fa4dd2016-08-12Candidate
Montana State AGbd_536d1c17f10a57142016-08-12Verified
California State AGbd_62ea62ba052757f32016-08-12Verified
Massachusetts State AGbd_6c09aa6edcca020f2016-08-12Verified

Show 1 more filing ↓

HHS OCRbd_ebf01ca47ea1047c2016-08-12Verified

Name: Valley Anesthesiology Consultants, Inc.
norm: valley anesthesiology consultants

Name: Valley Anesthesiology Consultants, Inc.
norm: valley anesthesiology consultants
Industry: Healthcarellm

Discovered: Jun 13, 2016
Breach occurred: Mar 30, 2016
Undetected for: 75 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 12, 2016
Affected individuals: 611state-resident count only
Data types: Identity (basic)Government IDHealth (basic)Minor
Data elements: Medical informationHealth insurance IDSocial Security numberName
WA-stated cause: Unauthorized Access
WA-stated duration: lifecycle Unknowndexposure Unknownd
WA-stated discovery: Found after the fact
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified Washington Attorney General
Initial access: valid_credentials

During the incident: Hiring a leading forensics firm to assist VAPC
Notifying law enforcement
Offering affected individuals a free one-year membership in credit monitoring and identity theft protection services through Experian
Established a dedicated call center
Changes made: Reviewing its security processes
Strengthening its network firewalls
Continuing to incorporate best practices in IT Security
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(60 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Oregon State AGAug 12 · first

Montana State AGAug 12 · first

California State AGAug 12 · first

Massachusetts State AGAug 12 · first

HHS OCRAug 12 · first

Washington State AGAug 12 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9637.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 12, 2016
Raw hash: 505510e9adec235cec8549c50b7c068468564c0c28a6d422cdc07160aea04734

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityValley Anesthesiology Consultants, Inc.

Victim entityValley Anesthesiology Consultants, Inc.

Incidentdiscovered Jun 13, 2016

Stated responseHiring a leading forensics firm to assist VAPC

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com