Cyber Incident Victim: Topcon Healthcare Solutions
Date:
Jan 2023
Location:
United States of America
Summary
Topcon Healthcare Solutions experienced a cybersecurity incident involving unauthorized access to documents on its systems over a one-month period, impacting 4,209 individuals. The breach investigation remains ongoing to determine the specific types of exposed protected health information, with notification letters pending completion of this review. The incident was reported to regulatory authorities as a data compromise affecting patient confidentiality.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 2 techniques |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
Topcon Healthcare Solutions, a provider of imaging, diagnostic, and intelligent data technologies, detected a security breach on February 5, 2023. A forensic investigation confirmed unauthorized access to documents on its systems between January 7, 2023, and February 5, 2023. The company reported the breach to the Maine Attorney General, indicating that protected health information was exposed and up to 4,209 individuals were affected. Topcon disclosed the incident publicly through a breach notification dated May 22, 2023, though the investigation remained ongoing at the time of reporting. The unauthorized access period spanned 29 days before detection, during which attackers compromised documents stored on Topcon's infrastructure.
The organization stated its review process was still working to determine the specific types of exposed information, delaying individual notifications until the analysis concluded. No details were provided about the methods used to gain unauthorized access, whether data was exfiltrated, or if ransomware or encryption was involved. Topcon did not disclose operational impacts, system downtime, or whether data restoration from backups was required. The breach notification confirmed planned communications to affected individuals once the scope was fully mapped, but no complementary protections like credit monitoring were mentioned. As of the latest reported update, the forensic examination continued without public confirmation of final data categories compromised or evidence of misuse.