MalwareHealthcareHealthcareRansomwareData EncryptedCustomer Data InvolvedEmployee Data InvolvedPHIHealth (basic)Identity (basic)Government IDFinancial accountMediumContained

Sonoma Valley Hospital

bd_042d879cab2d30db · schema v1 · pii pii-v1

Severity

Medium

Discovered

Oct 11, 2020

Filed

Dec 9, 2020

To disclose

8 weeks

Affected

Not disclosed

Linked

4 records

Confidence

66%

Full breach record for Sonoma Valley Hospital →2 incidents on file

Sonoma Valley Hospital suffered a ransomware attack on October 11, 2020, attributed to a Russian threat actor. The incident occurred between September 10 and October 11, 2020. Patient health information (PHI), including names, addresses, birthdates, insurer details, and diagnosis codes, was potentially disclosed. Employee data, including SSNs and health test results, was also compromised. Systems were shut down to contain the attack, and ransom was not paid. Enhanced security measures were implemented.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 31 days

discovery → filing · 8 weeks / 59 days

Sep 10, 2020

Begins

Oct 11, 2020

Discovered

Dec 9, 2020

Filed

vs. sector median

1 wks faster

This filing is one of 4 records about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Siteryukbd_d5c0b92a97b9e8c72020-10-11 · +59dVerified

Regulatory filings (2) · sorted by filing gap

Montana State AGbd_26a8ae0667f4e68c2020-12-11 · +2dVerified
Oregon State AGbd_998c2c215de23dc22020-12-11 · +2dVerified by operator

Name: Sonoma Valley Healthcare District
norm: sonoma valley healthcare district

Name: Sonoma Valley Hospital
norm: sonoma valley hospital
Domain: svh.com
Industry: Healthcarellm

Discovered: Oct 11, 2020
Breach occurred: Sep 10, 2020 – Oct 11, 2020
Undetected for: 31 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: PHIHealth (basic)Identity (basic)Government IDFinancial account
Data elements: Social Security numberDate of birthMedical information
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for Impact
Threat actor: ExternalFinancial
Regulator citations: Notified law enforcement of the incident

During the incident: Shutting down all systems to contain the damage
Notified law enforcement of the incident
Engaged a leading external cybersecurity firm to assess the potential disclosure of protected health information
Successfully prevented the cybercriminal from blocking our system access and ultimately expelled them from our system
Activated a series of enhanced security measures to improve information security and prevent further ransomware or cybersecurity attacks
Changes made: Activated a series of enhanced security measures to improve information security and prevent further ransomware or cybersecurity attacks
Secured the services of Kroll to provide identity monitoring at no cost to employees for one year
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(59 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

California State AGDec 9 · first · this page

Montana State AG+2d

Oregon State AG+2d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-196956
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 9, 2020
Raw hash: 9a8afa36528aa755c8c34588d3ad14aa4cbe1848903fc04ea063ca1b5221b523

Linked disclosures

Ransomware claims (1)

Regulatory filings (2) · sorted by filing gap

Reporting entitySonoma Valley Healthcare District

Victim entitySonoma Valley Hospital

Incidentdiscovered Oct 11, 2020

Stated responseShutting down all systems to contain the damage

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov