THE MEDICAL COLLEGE OF WISCONSIN, INC.

Medical College of Wisconsin notified NH AG of a third-party vendor breach involving MOVEit Transfer. Unauthorized access occurred on or about May 27, 2023, discovered Sept 21, 2023. ~17 NH residents affected with PII. MCW patched the system, engaged forensic investigators, and offered credit monitoring.

Medical College of Wisconsin notified affected individuals of a third-party data incident involving the MOVEit Transfer solution. Unauthorized actors exploited a vulnerability in MOVEit to access data stored on MCW's server on May 27, 2023. MCW discovered the incident on September 21, 2023. Personal information, potentially including SSNs and government IDs, was removed. MCW engaged third-party investigators and offered credit monitoring services.

Medical College of Wisconsin reported to HHS on 2023-11-14 a Hacking/IT Incident affecting 240,667 individuals. A third-party vendor experienced a cybersecurity incident allowing unauthorized access to its network server, compromising PHI including names, addresses, SSNs, dates of birth, claims information, diagnoses, lab results, and medications. The CE notified HHS, affected individuals, and the media, and terminated its relationship with the vendor.

Medical College of Wisconsin notified consumers of a data breach involving its MOVEit Transfer vendor. Unauthorized actors accessed files containing personal information (names, addresses, SSNs, health data) on May 27, 2023. MCW discovered the incident on September 21, 2023, engaged forensic investigators, and is offering credit monitoring services.

Medical College of Wisconsin reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2023-11-14. 98 Massachusetts residents were affected. The report records the breach type as electronic.

The Medical College of Wisconsin, Inc. reported to HHS on 2020-10-11 a Hacking/IT Incident (ransomware) affecting 5,655 individuals. The covered entity's business associate experienced a ransomware attack affecting ePHI stored on a Network Server. Exposed ePHI included names, addresses, dates of birth, and treatment information. The CE notified HHS, affected individuals, and the media, and provided substitute notice.

MEDICAL COLLEGE OF WISCONSIN filed a data-breach notice with the Illinois Attorney General during 2020 (case 20-415). The register records the breach as discovered on July 16, 2020. Illinois does not publish the number of people affected — 815 ILCS 530/10 permits the Attorney General to publish only the entity name, the types of personal information and the date range.

MEDICAL COLLEGE OF WISCONSIN filed a data-breach notice with the Illinois Attorney General during 2020 (case 20-490). The register records the breach as discovered on October 22, 2020. Illinois does not publish the number of people affected — 815 ILCS 530/10 permits the Attorney General to publish only the entity name, the types of personal information and the date range.

Medical College of Wisconsin reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2019-08-14. 8 Massachusetts residents were affected. The report records the breach type as electronic.

The Medical College of Wisconsin, Inc. reported a data breach to the Oregon Attorney General. The breach was reported on 2017-11-30. The breach occurred during 7/21/2017 - 7/28/2017. The breach was discovered on 9/20/2017. 9,500 individuals were affected. Notice was sent on 11/17/2017.

The Medical College of Wisconsin (MCW) notified Washington AG that a phishing attack compromised employee email accounts between July 21-28, 2017. Unauthorized access occurred, potentially exposing patient PII, SSNs, medical records, and financial data. MCW engaged forensic investigators, secured accounts, and offered credit monitoring to affected individuals.

The Medical College of Wisconsin, Inc. reported to HHS on 2017-11-17 a Hacking/IT Incident affecting 9,500 individuals. Several employees were victims of an email phishing attack; compromised email accounts contained PHI including names, dates of birth, addresses, Social Security numbers, medical record numbers, health insurance information, financial information, and treatment information. Breached information was located in Email. The CE implemented administrative and technical safeguards, retrained staff, and notified HHS, individuals, and media. OCR obtained corrective-action assurances.

Medical College of Wisconsin reported a data breach to the Montana Attorney General. The breach was reported on 2017-11-17. The breach occurred from 7/21/2017 to 7/28/2017. 1 Montana residents were affected.

Medical College of Wisconsin reported to HHS on 2016-09-02 a Hacking/IT Incident affecting 3179 individuals. Breached information located on Email. An unauthorized third-party accessed an employee's email account containing PHI (names, addresses, DOB, MRNs, diagnoses, SSNs) for three days. The CE retained a forensic firm, retrained the employee, and implemented new safeguards.