MalwareHealthcareHealthcareRansomwareStolen CredentialsData ExfiltratedRansom DemandedTargetedPIIPHIIdentity (basic)LowContained

Victoria Eye Center

bd_f74fe51206516222 · schema v1 · pii pii-v1

Severity

Low

Discovered

Mar 21, 2024

Filed

May 28, 2024

To disclose

10 weeks

Affected

2state residents only

Linked

5 filings

Confidence

67%

Full breach record for Victoria Eye Center →

Victoria Eye Center (and affiliates) notified NH DOJ of a ransomware incident discovered March 21, 2024. An unknown actor encrypted files and accessed systems. 2 NH residents affected. PHI and PII involved. Response included forensic investigation, system restoration, enhanced security, and IDX identity protection for victims.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 10 weeks / 68 days

Mar 21, 2024

Discovered

May 28, 2024

Filed

vs. sector median

1 wks faster

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

South Carolina State AGbd_9bb67aa48e32e3a82024-05-29 · +1dVerified
Montana State AGbd_99d506f349edab142024-05-22 · +6dVerified
Maine State AGbd_d2a33fb92e57c7792024-05-21 · +7dVerified
HHS OCRbd_6128a9e2d2639a692024-05-17 · +11dVerified

Name: Victoria Eye Center
norm: victoria eye center

Name: Victoria Eye Center
norm: victoria eye center
Industry: Healthcarellm

Discovered: Mar 21, 2024
Materiality determined: —
Notification sent: May 13, 2024
Affected individuals: 2state-resident count only
Data types: PIIPHIIdentity (basic)
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Department of Justice
Initial access: valid_credentials

During the incident: Launched an extensive investigation, aided by third party computer forensic specialists
Secured VEC systems
Restore access to the information
Investigate what happened
Forwarded letters notifying them of this incident
Conducted an investigation to understand what had taken place and how
Secured their system and offices
Reviewed their internal data management and protocols
Implemented enhanced security measures
Offering identity theft protection services through IDX
Changes made: Reviewed their internal data management and protocols
Implemented enhanced security measures to help prevent this type of incident from recurring
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 10 weeks(68 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

HHS OCRMay 17 · first

Maine State AG+4d

Montana State AG+5d

New Hampshire State AG+11d · this page

South Carolina State AG+12d

Pattern: first filing May 17 (TX), last May 29 (SC) — a 12-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/victoria-eye-center-surgery-vision-20240528.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 28, 2024
Raw hash: b7f498d7d54a459dd30edba69d9536a177a9a9eb2a25018c46370b41bb467f07

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityVictoria Eye Center

Victim entityVictoria Eye Center

Incidentdiscovered Mar 21, 2024

Stated responseLaunched an extensive investigation, aided by third party computer forensic specialists

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov