MalwareHealthcareTechnologyHealthcarePhishingRansomwareData ExfiltratedData EncryptedCustomer Data InvolvedMulti-Stage ChainIdentity (basic)PIILowContained

Medsurant Holdings, LLC

bd_f7bbed94b59f6f6a · schema v1 · pii pii-v1

Severity

Low

Discovered

Sep 30, 2021

Filed

Mar 25, 2022

To disclose

25 weeks

Affected

91state residents only

Linked

5 filings

Confidence

66%

Full breach record for Medsurant Holdings, LLC →2 incidents on file

Medsurant Holdings, LLC notified individuals of a cybersecurity incident where an unknown actor gained unauthorized access via a suspicious email on September 30, 2021. Data was exfiltrated and some data was encrypted (ransomware) but restored. Affected data includes names and addresses. Medsurant engaged forensic reviewers, notified law enforcement and HHS, and offered 24 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 7 days

discovery → filing · 25 weeks / 176 days

Sep 23, 2021

Begins

Sep 30, 2021

Discovered

Mar 25, 2022

Filed

vs. sector median

+13 wks slower

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

California State AGbd_cdffc9b5517e1fd12022-03-25Verified
Indiana State AGbd_d7d3c83e8e3b408a2022-03-25Verified
Illinois State AGbd_1dea62a2b1f475232022-01-01 · +83dCandidate
Illinois State AGbd_f0108592a796f74f2022-01-01 · +83dVerified

Name: Medsurant Holdings, LLC
norm: medsurant holdings

Name: Medsurant Holdings, LLC
norm: medsurant holdings
Industry: HealthcarellmTechnologyllm

Discovered: Sep 30, 2021
Breach occurred: Sep 23, 2021 – Nov 12, 2021
Undetected for: 7 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 91state-resident count only
Data types: Identity (basic)PII
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1041 Exfiltration Over C2 ChannelT1486 Data Encrypted for Impact
Threat actor: ExternalFinancial
Regulator citations: Notified federal law enforcementNotified the U.S. Department of Health and Human Services
Initial access: phishing_link

During the incident: Implementing additional network monitoring
Beginning a forensic review
Reviewing existing policies and procedures
Implementing additional administrative and technical safeguards
Notified federal law enforcement
Notified the U.S. Department of Health and Human Services
Notified other government regulators
Offering 24 months of complimentary credit monitoring and identity restoration services through Equifax
Changes made: Implementing additional administrative and technical safeguards
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 25 weeks(176 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 4 states

View merged incident ↗

Illinois State AGJan 1 · first

California State AG+83d

Indiana State AG+83d

Montana State AG+83d · this page

Pattern: first filing Jan 1 (IL), last Mar 25 (MT) — a 83-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/Medsurant-Holdings-LLC-Consumer-Notification-Letter.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 25, 2022
Raw hash: e463b88d4b7da3bae957ae3571b04d5713637add26e1bf8aeb457a4bd9a684a2

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityMedsurant Holdings, LLC

Victim entityMedsurant Holdings, LLC

Incidentdiscovered Sep 30, 2021

Stated responseImplementing additional network monitoring

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov