Mountain Dermatology Specialists (“MDS”) recently discovered a cyber security incident which may have resulted in
unauthorized acquisition or disclosure of some individuals’ personal information or protected health information. MDS
deeply regrets this incident occurred. We are providing this notice to patients and to individuals who may have been
affiliated with MDS to let them know about the incident and what we are doing in response.
On October 26, 2023, MDS first discovered that an unauthorized individual gained access to an MDS employee’s work
email account. The hacker used the email to send phishing emails to contacts within the mailbox. MDS immediately secured
the employee’s email account to block the access and started investigating the incident. MDS with assistance from incident
response professionals determined as of November 24, 2023, that unauthorized access to the email account occurred
between October 24 and 26, 2023, and that the emails in the mailbox could have been acquired by the hacker. MDS promptly
began analyzing the contents of all emails in the account to identify all potentially impacted individuals and the nature and
types of information involved. On December 22, 2023, MDS mailed notice letters to each impacted individual for whom it
had a current mailing address.
The type of information involved varied by individual but may have included any of the following: full name, address, date
of birth, phone number, email address, date(s) of treatment, type of treatment or condition, diagnosis, medications, and
certain health insurance information or cost/billing, or amount paid, and for a small percentage of individuals social security
number, and/or compensation and benefits information were involved. MDS’s electronic medical record database was NOT
involved in the incident.
In response to the incident, MDS has been enhancing its cybersecurity protections. MDS worked with IT professionals to
implement password resets, increase monitoring, and is reviewing enhancement options for email account security. MDS is
reinforcing security awareness and providing additional training to its entire workforce. Additionally, MDS reported this
incident to law enforcement for further investigation.
For individuals who may have had information involved in this incident, MDS wants to make them aware of steps they may
take to protect against potential harm. MDS encourages individuals to remain vigilant to the possibility of fraud and identity
theft by regularly reviewing their financial statements, credit reports, and explanation of benefits (EOBs) from health
insurers for any unauthorized activity. If individuals identify services that they did not receive or accounts, charges, or
withdrawals that they did not authorize, report to the involved company or credit-reporting agency immediately. In addition,
individuals can obtain information about placing fraud alerts and security freezes from the Federal Trade Commission and
the three national credit reporting agencies at the toll-free numbers, websites, or mailing addresses as follows:

MDS has also arranged for individuals with information involved in this incident to have complimentary access to certain
identity restoration services and to fraud detection tools for 12 months. The enrollment deadline for involved individuals to
activate the complimentary fraud detection tools is March 15, 2024. For individuals who did not receive a notice letter but
whose information may have been involved, they may contact the toll-free number below, and if they are determined to be
involved, they will be provided instructions and an activation code to be used by the enrollment deadline of March 15, 2024.
MDS has partnered with Experian’s customer care team to set up a call center to help answer questions. Individuals who
have questions or would like more information, including whether their personal information was involved, should call 855-
223-4826 toll-free, Monday through Friday 7 am – 7 pm MST (excluding major U.S. holidays). Please be prepared to
provide your engagement number B112377.
4862-9301-1352, v. 1