MalwareHealthcareHealthcareRansomwareData EncryptedCustomer Data InvolvedPHIHealth (basic)Identity (basic)LowContained

MedPeds Associates of Sarasota

bd_f5fef79475594d25 · schema v1 · pii pii-v1

Severity

Low

Discovered

Sep 2, 2025

Filed

Mar 16, 2026

To disclose

28 weeks

Affected

Not disclosed

Linked

5 filings

Confidence

66%

Full breach record for MedPeds Associates of Sarasota →

MedPeds Associates of Sarasota reported that on September 2, 2025, an unknown entity gained access to its computer system and deployed ransomware that encrypted data. Patient information, including names, dates of birth, addresses, phone numbers, and medical records, was accessed. The company engaged a forensic firm, contacted the FBI, and implemented additional security safeguards. No misuse of data has been observed.

J jump to incidentP pin to compareR raw source

Vermont clock✗ VT AG >45 bday28 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 28 weeks / 195 days

Sep 2, 2025

Begins

Sep 2, 2025

Discovered

Mar 16, 2026

Filed

vs. sector median

+15 wks slower

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Nebraska State AGbd_4bb5a1b5d650cfb92026-03-16Verified
Maine State AGbd_4e606e92c99d61622026-03-16Verified
Indiana State AGbd_bf13059c2b0bb4a62026-03-16Verified
HHS OCRbd_693ed259aa941ef62026-03-13 · +3dVerified

Name: MedPeds Associates of Sarasota
norm: medpeds associates of sarasota

Name: MedPeds Associates of Sarasota
norm: medpeds associates of sarasota
Industry: Healthcarellm

Discovered: Sep 2, 2025
Breach occurred: Sep 2, 2025
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 16, 2026
Affected individuals: Not disclosed
Data types: PHIHealth (basic)Identity (basic)
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1078 Valid Accounts
Threat actor: External
Regulator citations: Immediately contacted the FBI and worked with their cyber security department

During the incident: Worked to restore our computer system with a forensic firm
Immediately improved our security and protect our system from further unauthorized access
Immediately contacted the FBI and worked with their cyber security department
Implemented additional safeguards to improve data security on our web server infrastructure
Partnered with IDX to answer questions and provide valuable information about the incident
Changes made: Implemented additional safeguards to improve data security on our web server infrastructure
Taking additional steps to protect patient related data from theft or similar criminal activity in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 28 weeks(195 days from discovery to filing)
Compliance flags: VT AG >45 bday
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

HHS OCRMar 13 · first

Nebraska State AG+3d

Maine State AG+3d

Indiana State AG+3d

Vermont State AG+3d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ago.vermont.gov/document/2026-03-16-medpeds-associates-sarasota-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 16, 2026
Raw hash: 5694d0fa2fb60f86c2ac5bbfb46c68219b244a6174e1ee9b007fdd0efb28c818

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityMedPeds Associates of Sarasota

Victim entityMedPeds Associates of Sarasota

Incidentdiscovered Sep 2, 2025

Stated responseWorked to restore our computer system with a forensic firm

ComplianceVT AG >45 bday

Extraction provenanceno artifact recorded

Source provenanceago.vermont.gov