HackingIdentity (basic)Government IDFinancialHealth (basic)PHIMediumContained

Sharper Vision P.A.

bd_fbb6880c512594b1 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Dec 6, 2021

Filed

Jun 17, 2022

To disclose

28 weeks

Affected

1state residents only

Linked

3 filings

Confidence

66%

Full breach record for Sharper Vision P.A. →2 incidents on file

Sharper Vision P.A. notified patients of a third-party vendor breach involving Eye Care Leaders (ECL), which manages Sharper Vision's EMR system. An unauthorized actor accessed ECL's systems on Dec 4, 2021. While the scope of accessed data is undetermined, patient files potentially containing PHI, SSNs, and financial info were at risk. Sharper Vision offered credit monitoring and is reviewing vendor security policies.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 2 days

discovery → filing · 28 weeks / 193 days

Dec 4, 2021

Begins

Dec 6, 2021

Discovered

Jun 17, 2022

Filed

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

HHS OCRbd_86dddc08d30696cc2022-06-17Verified
New Hampshire State AGbd_68341ad17e0f64552022-06-23 · +6dVerified

Name: Sharper Vision P.A.
norm: sharper vision

Name: Sharper Vision P.A.
norm: sharper vision

Discovered: Dec 6, 2021
Breach occurred: Dec 4, 2021
Undetected for: 2 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government IDFinancialHealth (basic)PHI
Data elements: Social Security numberDate of birthMedical information
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain CompromiseT1078 Valid Accounts
Threat actor: External
Regulator citations: notifying state and federal regulators
Initial access: valid_credentials

During the incident: Immediately launched an investigation to determine the nature and scope of this incident
Reviewing existing security policies and procedures regarding our third-party vendors
Evaluating additional measures to further protect against similar incidents moving forward
Notifying state and federal regulators
Offering credit monitoring and identity theft protection services for <<CM length>> months through Equifax
Changes made: Reviewing existing security policies and procedures regarding our third-party vendors
Evaluating additional measures to further protect against similar incidents moving forward
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 28 weeks(193 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

HHS OCRJun 17 · first

Montana State AGJun 17 · first · this page

New Hampshire State AG+6d

Pattern: first filing Jun 17 (KS), last Jun 23 (NH) — a 6-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-Notification-Letter-2.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 17, 2022
Raw hash: c32b6d7cafb4b5c967f5071e5cef7d650d9b500090fb5c0e59e23fc8cebd4e13

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entitySharper Vision P.A.

Victim entitySharper Vision P.A.

Incidentdiscovered Dec 6, 2021

Stated responseImmediately launched an investigation to determine the nature and scope of this incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov