MalwareHealthcareHealthcareRansomwareCapture Stored DataData ExfiltratedData EncryptedCustomer Data InvolvedIdentity (basic)Government IDHealth (basic)Financial accountMediumContained

Florida Orthopaedic Institute

bd_f8e2e4feb154cc09 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 9, 2020

Filed

Jun 22, 2020

To disclose

11 weeks

Affected

289state residents only

Linked

6 filings

Confidence

67%

Florida Orthopaedic Institute notified NH AG of a ransomware attack discovered April 9, 2020. Attack encrypted servers and exfiltrated patient PII (SSN, DOB, medical info). 289 NH residents affected. Notifications sent June 22, 2020. Remediation included enhanced AV, firewalls, and access controls. 12 months credit monitoring offered.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 11 weeks / 74 days

Apr 9, 2020

Discovered

Jun 22, 2020

Filed

vs. sector median

2 wks faster

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Montana State AGbd_012235dae82ea25b2020-06-22Candidate
Massachusetts State AGbd_82e8625c5ca8d7de2020-06-22Verified
California State AGbd_9b712997a5d8567e2020-06-22Verified
Indiana State AGbd_fae168e43f6afb9f2020-06-22Verified

Show 1 more filing ↓up to 9d gap

HHS OCRbd_811b98dae592a09c2020-07-01 · +9dVerified

Name: Florida Orthopaedic Institute
norm: florida orthopaedic institute

Name: Florida Orthopaedic Institute
norm: florida orthopaedic institute
Industry: Healthcarellm

Discovered: Apr 9, 2020
Materiality determined: —
Notification sent: Jun 22, 2020
Affected individuals: 289state-resident count only
Data types: Identity (basic)Government IDHealth (basic)Financial account
Data elements: Social Security numberDate of birthMedical information
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney General

During the incident: Engaged a third-party forensic investigator to assist with the investigation
Offering twelve (12) months of complimentary credit and identity monitoring services
Changes made: Implemented a more robust antivirus program
Added additional firewalls
Reduced external access
Implemented additional auditing and tracking of external access
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 11 weeks(74 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Montana State AGJun 22 · first

Massachusetts State AGJun 22 · first

California State AGJun 22 · first

Indiana State AGJun 22 · first

New Hampshire State AGJun 22 · first · this page

HHS OCR+9d

Pattern: first filing Jun 22 (MT), last Jul 1 (FL) — a 9-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/florida-orthopaedic-institute-20200622.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 22, 2020
Raw hash: 8d95f94abf6fb56639025ac9683a1bdc4c36fe841573e681a766a808c7a3a8f1

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityFlorida Orthopaedic Institute

Victim entityFlorida Orthopaedic Institute

Incidentdiscovered Apr 9, 2020

Stated responseEngaged a third-party forensic investigator to assist with the investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov