PhysicalHealthcareHealthcareTheftCustomer Data InvolvedTargetedIdentity (basic)Financial accountFinancial credentialsPIILowContained

Sierra Nevada Primary Care Physicians

bd_f0ff997dab959843 · schema v1 · pii pii-v1

Severity

Low

Discovered

May 20, 2021

Filed

Jul 16, 2021

To disclose

8 weeks

Affected

4state residents only

Linked

5 filings

Confidence

65%

Full breach record for Sierra Nevada Primary Care Physicians →

Sierra Nevada Primary Care Physicians notified Montana residents of a data breach where two envelopes containing patient payment receipts were stolen from a suspect's vehicle. The incident involved names and credit card details from payments made between Jan 1, 2019, and Mar 20, 2019. The organization offered 12 months of identity theft protection services.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 870 days

discovery → filing · 8 weeks / 57 days

Jan 1, 2019

Begins

May 20, 2021

Discovered

Jul 16, 2021

Filed

vs. sector median

3 wks faster

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Maine State AGbd_7c18aa2787bbc1f42021-07-16Verified
California State AGbd_a4c7d003c1dbf6ce2021-07-16Verified
HHS OCRbd_f81da92a987436522021-07-16Verified
Illinois State AGbd_4239a30ece11c39e2021-01-01 · +196dCandidate

Name: Sierra Nevada Primary Care Physicians
norm: sierra nevada primary care physicians

Name: Sierra Nevada Primary Care Physicians
norm: sierra nevada primary care physicians
Industry: Healthcarellm

Discovered: May 20, 2021
Breach occurred: Jan 1, 2019 – Mar 20, 2019
Undetected for: 870 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 16, 2021
Affected individuals: 4state-resident count only
Data types: Identity (basic)Financial accountFinancial credentialsPII
Attack vector: Unknown
MITRE ATT&CK: T1052 Exfiltration Over Physical Medium
Threat actor: ExternalFinancial
Regulator citations: Notified District Attorney's office

During the incident: Offering identity theft protection services through IDX
Providing 12 months of CyberScan monitoring
Providing a $1,000,000 insurance reimbursement policy
Providing fully managed id theft recovery services
Changes made: All receipts are stored in a locked room that only two people have access to
Credit or debit card numbers are blacked-out on the receipts
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(57 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 4 states

View merged incident ↗

Illinois State AGJan 1 · first

Maine State AG+196d

California State AG+196d

HHS OCR+196d

Montana State AG+196d · this page

Pattern: first filing Jan 1 (IL), last Jul 16 (MT) — a 196-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/a-notif-90.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 16, 2021
Raw hash: f3c6f63633adacf40621e3ba527c4f9fcfca477331720f711eb204ac513e408d

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entitySierra Nevada Primary Care Physicians

Victim entitySierra Nevada Primary Care Physicians

Incidentdiscovered May 20, 2021

Stated responseOffering identity theft protection services through IDX

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov