HackingHealthcareHealthcareStolen CredentialsData ExfiltratedTargetedIdentity (basic)Government IDHealth (basic)PIIMediumContained

AspenPointe Properties

bd_eca0abbdd7293048 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 22, 2020

Filed

Nov 19, 2020

To disclose

8 weeks

Affected

38state residents only

Linked

3 filings

Confidence

65%

Full breach record for AspenPointe Properties →2 incidents on file

AspenPointe notified Montana residents of unauthorized network access occurring between Sept 12-22, 2020. The incident compromised names, DOBs, SSNs, Medicaid IDs, and medical data. AspenPointe engaged forensic investigators, reset passwords, and enhanced security controls. Affected individuals were offered 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 10 days

discovery → filing · 8 weeks / 58 days

Sep 12, 2020

Begins

Sep 22, 2020

Discovered

Nov 19, 2020

Filed

vs. sector median

4 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

HHS OCRbd_e50d29e14762cd892020-11-19Verified
Indiana State AGbd_efe03565344cfc9b2020-11-19Verified

Name: AspenPointe Properties
norm: aspenpointe properties

Name: AspenPointe Properties
norm: aspenpointe properties
Industry: Healthcarellm

Discovered: Sep 22, 2020
Breach occurred: Sep 12, 2020 – Sep 22, 2020
Undetected for: 10 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 19, 2020
Affected individuals: 38state-resident count only
Data types: Identity (basic)Government IDHealth (basic)PII
Data elements: Social Security numberDate of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: ExternalFinancial
Initial access: valid_credentials

During the incident: Launched an investigation in consultation with outside cybersecurity professionals
Forced password changes
Implemented additional endpoint protection
Increased monitoring
Implemented firewall changes
Offering complimentary identity theft protection services through IDX
Changes made: Implemented additional endpoint protection
Increased monitoring
Implemented firewall changes
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(58 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

HHS OCRNov 19 · first

Indiana State AGNov 19 · first

Montana State AGNov 19 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/Aspenpoint-notif.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 19, 2020
Raw hash: 643405c63eebf73bb2b7dd58246f27cfa6c5b0c92aadf0e7122326d8c4109dd9

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityAspenPointe Properties

Victim entityAspenPointe Properties

Incidentdiscovered Sep 22, 2020

Stated responseLaunched an investigation in consultation with outside cybersecurity professionals

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov