AccidentalHealthcareHealthcareMisconfigurationCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDFinancialMediumContained

INOVA HEALTH SYSTEM FOUNDATION

bd_04dc57415a207ed8 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 8, 2013

Filed

Mar 7, 2013

To disclose

27 days

Affected

4state residents only

Linked

2 filings

Confidence

67%

Full breach record for INOVA HEALTH SYSTEM FOUNDATION →6 incidents on file

Inova Health System notified the NH AG that a misconfigured Lawson eProfile application folder containing employee W-2 forms (SSN, name, address, earnings) was accessible to the internet. Discovered Feb 8, 2013. 4 NH residents affected. Notifications sent March 8, 2013. Credit monitoring offered.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 27 days

Feb 8, 2013

Discovered

Mar 7, 2013

Filed

vs. sector median

8 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_8f99b5620b7bbc872013-03-08 · +1dVerified

Name: INOVA HEALTH SYSTEM FOUNDATION
norm: inova health system

Name: INOVA HEALTH SYSTEM FOUNDATION
norm: inova health system
Industry: Healthcarellm

Discovered: Feb 8, 2013
Materiality determined: —
Notification sent: Mar 8, 2013
Affected individuals: 4state-resident count only
Data types: Identity (basic)Government IDFinancial
Data elements: Social Security number
Attack vector: Misconfiguration
MITRE ATT&CK: T1119 Automated Collection
Regulator citations: Notified New Hampshire Office of the Attorney General

During the incident: Corrected the file setting
Worked with search engines to remove any links to information in the file
Conducted an internal review of its practices and procedures
Arranged for individuals to enroll in a complimentary credit monitoring and identity theft protection service for one year provided by ProtectMyID from ConsumerInfo.com, Inc., an Experian company
Changes made: Conducted an internal review of its practices and procedures
Taken steps to prevent this from happening again in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 27 days(27 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

New Hampshire State AGMar 7 · first · this page

Massachusetts State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/inova-health-system-20130307.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 7, 2013
Raw hash: d7d21e7cee244d5716814663f19a9db1801ad7096bb58ec818ceb5307970d963

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityINOVA HEALTH SYSTEM FOUNDATION

Victim entityINOVA HEALTH SYSTEM FOUNDATION

Incidentdiscovered Feb 8, 2013

Stated responseCorrected the file setting

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov