HackingHealthcareHealthcareStolen CredentialsCustomer Data InvolvedTargetedIdentity (basic)Government IDHealth (basic)PHIMediumContained

Princeton Pain Management

bd_f15b50b2a99657e1 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 28, 2016

Filed

Jan 27, 2017

To disclose

9 weeks

Affected

2state residents only

Linked

3 filings

Confidence

67%

Full breach record for Princeton Pain Management →

Princeton Pain Management notified the NH AG of a data incident where a third party gained unauthorized access to its network on Nov 28, 2016. Affected data included names, SSNs, DOBs, driver's licenses, and PHI. No evidence of data acquisition was found. 2 NH residents affected. Incident contained; identity protection offered.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 9 weeks / 60 days

Nov 28, 2016

Discovered

Jan 27, 2017

Filed

vs. sector median

2 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

HHS OCRbd_afdc04249a1daa7f2017-01-27Verified
Massachusetts State AGbd_2c31206e12f8ade42017-01-30 · +3dVerified

Name: Princeton Pain Management
norm: princeton pain management

Name: Princeton Pain Management
norm: princeton pain management
Industry: Healthcarellm

Discovered: Nov 28, 2016
Materiality determined: —
Notification sent: Jan 27, 2017
Affected individuals: 2state-resident count only
Data types: Identity (basic)Government IDHealth (basic)PHI
Data elements: Social Security numberDate of birthMedical information
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: providing notice to potentially affected individuals and to the U.S. Department of Health and Human Services
Initial access: valid_credentials

During the incident: Initiating an internal investigation
Engaging outside forensic experts to assist PPM in investigating and remediating the situation
Reconfigured various components of its network to enhance security
Offering twelve months of complimentary identity protection services
Changes made: Reviewing our security processes and updating system protections designed to help prevent this type of incident from recurring in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(60 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

HHS OCRJan 27 · first

New Hampshire State AGJan 27 · first · this page

Massachusetts State AG+3d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/princeton-pain-20170127.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 27, 2017
Raw hash: eaefd831c2bca3744b268142b3fb712811b4444031b28c0e7b0a48a7232826e9

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityPrinceton Pain Management

Victim entityPrinceton Pain Management

Incidentdiscovered Nov 28, 2016

Stated responseInitiating an internal investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov