Social EngineeringHealthcareGovernment IDIdentity (basic)MediumContained

AURIS HEALTH, INC.

bd_e8495fd81420ceaa · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Jan 29, 2021

To disclose

—

Affected

2state residents only

Linked

5 filings

Confidence

67%

Full breach record for AURIS HEALTH, INC. →

Auris Health, Inc. notified the New Hampshire Attorney General's Office on January 27, 2021, regarding a phishing incident where an unauthorized third party accessed an employee's email account as of March 15, 2020. The breach potentially exposed the full names and Social Security numbers of two New Hampshire residents. Auris halted the activity, notified the affected individuals, and provided them with two years of complimentary credit and identity fraud monitoring through Equifax.

J jump to incidentP pin to compareR raw source

Incident timeline

Mar 15, 2020

Begins

Jan 29, 2021

Filed

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Indiana State AGbd_38fb2b9e7fa9f5b02021-01-27 · +2dVerified
Massachusetts State AGbd_737d0df43122f2212021-01-27 · +2dVerified
California State AGbd_e19d38c42139e27c2021-01-27 · +2dCandidate
Oregon State AGbd_e52872cd6b8c957f2021-01-27 · +2dVerified

Name: AURIS HEALTH, INC.
norm: auris health

Name: AURIS HEALTH, INC.
norm: auris health

Discovered: —
Breach occurred: Mar 15, 2020
Materiality determined: —
Notification sent: Jan 27, 2021
Affected individuals: 2state-resident count only
Data types: Government IDIdentity (basic)
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing Link
Threat actor: External
Initial access: phishing_link

During the incident: Took action to halt the unauthorized activity
Ensure the security of its system and remediate the issue
Taking steps to ensure that the unauthorized activity had ceased
Providing notice to all potentially impacted individuals and applicable regulators
Working to determine the full nature and scope of the event
Remediate any identified vulnerabilities
Enhance the security controls of its systems
Notify two New Hampshire residents of this incident
Provide these individuals with an offer for two years of a complimentary three-bureau credit and identity fraud monitoring service provided by Equifax
Changes made: Remediate any identified vulnerabilities
Enhance the security controls of its systems
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Indiana State AGJan 27 · first

Massachusetts State AGJan 27 · first

California State AGJan 27 · first

Oregon State AGJan 27 · first

New Hampshire State AG+2d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/auris-health-20210129.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 29, 2021
Raw hash: e42661fd1365708caa0a943119b3255931a87ab9c0bddb75d35171334ba7ead6

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityAURIS HEALTH, INC.

Victim entityAURIS HEALTH, INC.

IncidentPhishing

Stated responseTook action to halt the unauthorized activity

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov