MEDNAX Services, Inc. data breach (2020)

🐻California State AGFirst filing

Filed Dec 16, 2020bd_1253ca6eeacfa879

MEDNAX Services, Inc. reported a phishing incident affecting business email accounts between June 17 and June 22, 2020. Discovered on June 19, 2020, the breach impacted a small number of accounts, potentially exposing patient PII, SSNs, and health information. 45 Rhode Island residents were notified. MEDNAX engaged forensic investigators, reset passwords, and offered one year of identity monitoring.

Affected (this filing): 45

FEDERALHHS OCR

Filed Dec 16, 2020bd_2317d15fb2fdc537

MEDNAX Services, Inc. (now Pediatrix Medical Group), acting as a HIPAA Business Associate, reported to HHS OCR on 2020-12-16 that an email phishing attack compromising multiple employee mailboxes exposed PHI of 1,442,997 individuals. Affected data included names, addresses, dates of birth, driver's license numbers, Social Security numbers, health insurance information, claims/financial information, and treatment information. The entity notified HHS, affected individuals, media, and provided substitute notice; remediation included additional technical safeguards and staff retraining on email security.

Affected (this filing): 1,442,997

HHS notified

🦫Oregon State AGlinked via same-victim cross-source · 100%

Filed Dec 16, 2020bd_cc27b0970ea64726

MEDNAX Services, Inc. reported a data breach to the Oregon Attorney General. The breach was reported on 2020-12-16. The breach occurred during 6/17/2020 - 6/22/2020. The breach was discovered on 6/19/2020. 2,411 individuals were affected. Notice was sent on 12/16/202012/17/202012/18/2020.

Affected (this filing): 2,411

OR AG >45d

🌲Washington State AGlinked via same-victim cross-source · 100%

Filed Dec 16, 2020bd_ef1f98abb4d60c8e

MEDNAX Services, Inc., a health sector entity reported a phishing incident to the Washington Attorney General. The organization became aware of the incident on 2020-06-19 and filed notice on 2020-12-16. 29,861 Washington residents were affected. 180 days elapsed between awareness and notification. 2 days to identify the breach. 3 days to contain the breach.

Affected (this filing): 29,861

WA AG >90d

🐻California State AG

Filed Dec 23, 2020bd_11476f6352fa2626

MEDNAX Services, Inc. reported a data security event where an unauthorized third party accessed a Microsoft Office 365 business email account via phishing. The breach occurred between July 2 and July 3, 2020. Affected data may include patient contact information, Social Security numbers, health insurance details, medical records, and billing information. MEDNAX engaged a forensic firm, reset passwords, and offered one year of identity monitoring to affected individuals.

MEDNAX Services, Inc.

Litigation Timing

Sensitive data

Affected residents by state

Timeline