MalwareHealthcareHealthcareRansomwareData EncryptedTargetedIdentity (basic)Government IDHealth (basic)PHIMediumActive

Centrelake Medical Group, Inc.

bd_e9c07bcc54149335 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 19, 2019

Filed

Apr 22, 2019

To disclose

9 weeks

Affected

6state residents only

Linked

6 filings

Confidence

66%

Full breach record for Centrelake Medical Group, Inc. →2 incidents on file

Centrelake Medical Group, Inc. notified the NH AG of a data event affecting 6 NH residents. Suspicious activity occurred Jan 9–Feb 19, 2019, introduced by an unknown third party with server access. The incident involved a virus infection on Feb 19, 2019. Data potentially exposed included PHI, SSNs, and driver's licenses. Centrelake engaged forensic experts, restored systems, and offered 1 year of Kroll identity monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 41 days

discovery → filing · 9 weeks / 62 days

Jan 9, 2019

Begins

Feb 19, 2019

Discovered

Apr 22, 2019

Filed

vs. sector median

3 wks faster

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Montana State AGbd_2f595599bea258d22019-04-16 · +6dVerified
HHS OCRbd_4d4ab4bdac39256b2019-04-16 · +6dVerified
California State AGbd_5a79055f0c129f242019-04-16 · +6dVerified
Massachusetts State AGbd_95491b3edc63f1312019-04-16 · +6dVerified

Show 1 more filing ↓up to 23d gap

California State AGbd_1e7f4398452ebdf42019-05-15 · +23dVerified

Name: Centrelake Medical Group, Inc.
norm: centrelake medical

Name: Centrelake Medical Group, Inc.
norm: centrelake medical
Industry: Healthcarellm

Discovered: Feb 19, 2019
Breach occurred: Jan 9, 2019 – Feb 19, 2019
Undetected for: 41 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 16, 2019
Affected individuals: 6state-resident count only
Data types: Identity (basic)Government IDHealth (basic)PHI
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1078 Valid Accounts
Threat actor: External
Regulator citations: Notified the Department of Health and Human ServicesNotified the Centers for Medicaid and Medicare ServicesNotified consumer reporting agenciesNotified other state regulators
Initial access: trusted_relationship

During the incident: Restored the integrity of the information system
Launched an investigation with the assistance of a forensic expert
Provided potentially impacted individuals access to 1 free year of identity monitoring and restoration services through Kroll
Established a dedicated hotline for individuals to contact with questions or concerns
Provided written notice to business partners and potentially impacted individuals
Provided written notice to the Department of Health and Human Services
Provided written notice to the Centers for Medicaid and Medicare Services
Provided written notice to consumer reporting agencies and other state regulators
Changes made: Reviewing its processes, policies, and procedures that address data privacy
Enhancing the security of its information system to mitigate the risk an incident like this will occur in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(62 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 4 states

View merged incident ↗

Montana State AGApr 16 · first

HHS OCRApr 16 · first

California State AGApr 16 · first

Massachusetts State AGApr 16 · first

New Hampshire State AG+6d · this page

California State AG+29d

Pattern: first filing Apr 16 (MT), last May 15 (CA) — a 29-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/centrelake-20190422.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 22, 2019
Raw hash: 95b376bce7010089b72bee1c2f61846a6bee6500902e605d1ad0da2cbc931df1

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityCentrelake Medical Group, Inc.

Victim entityCentrelake Medical Group, Inc.

Incidentdiscovered Feb 19, 2019

Stated responseRestored the integrity of the information system

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov