Shields Health Care Group, a Massachusetts provider of medical imaging and ambulatory surgical centre management across New England, detected a security breach on 28 March 2022. Forensic investigation placed unauthorised network access between 7 and 21 March.
Reporting notes that a security alert had been triggered on 18 March, investigated, and determined not to involve a reportable breach. More than two million patients were affected, with reported categories including names, addresses, dates of birth, social security numbers, diagnoses, billing information, insurance numbers and treatment information. A $15.35 million settlement was later negotiated.
Detection Is Not The Hard Part
We have recorded dwell times in the hundreds of days — 425 at 23-0808b, 70 at 22-0118 — and the implied failure is usually that nothing noticed. Here something noticed, on day eleven of a fourteen-day intrusion.
What failed was the judgement applied to the signal. Somebody looked at the alert, formed a view, and closed it, and the intruders had three more days. That is a different problem from an absent control and it is not solved by buying more detection.
The Question Asked Was The Wrong One
The determination reported is that the alert did not involve a reportable breach. That framing is worth noticing: the triage question was regulatory rather than operational.
"Is this a notifiable event" and "is somebody in our network" are different questions with different answers, and only one of them has to be right on day eleven. We have argued at 26-0721b and 22-0120 that notification regimes shape organisational behaviour; this is that shaping reaching back into the investigation itself.
Patients Did Not Pick This Company
Shields provides imaging services on behalf of other providers. A patient attends a hospital and their scan is handled by a company they have no relationship with and were never asked about.
We have recorded that structure at 26-0721b, where a billing vendor held 442,000 patients, and at 26-0713. The $15.35 million settlement across two million people is the arithmetic the desk keeps recording at 25-1031: the remedy divides, and the harm does not.
Compiled from contemporaneous reporting and subsequent notification and litigation coverage, listed below. The characterisation of the 18 March determination comes from reporting of the company’s own account and this desk has not seen the underlying investigation. No actor is named — none was identified publicly. Class action filings are pleadings and no allegation from them is carried beyond the settlement figure. Graded high. Corrections: corrections@forensicpost.com.