HackingHealthcareHealthcareStolen CredentialsSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)Government IDFinancialMediumContained

Grande Ronde Hospital

bd_0d04a185278e58c1 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 20, 2020

Filed

Jun 3, 2020

To disclose

11 weeks

Affected

4state residents only

Linked

2 filings

Confidence

66%

Full breach record for Grande Ronde Hospital →

Grande Ronde Hospital notified employees of a third-party data breach involving PaperlessPay, a provider of pay stubs and tax forms. Unauthorized access to PaperlessPay's SQL server occurred on Feb 18, 2020, via stolen credentials. The hospital discovered the incident on March 20, 2020, and sent notifications on June 3, 2020. Data potentially exposed included names, addresses, SSNs, and financial info. No evidence of acquisition was found, but identity theft protection was offered.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 31 days

discovery → filing · 11 weeks / 75 days

Feb 18, 2020

Begins

Mar 20, 2020

Discovered

Jun 3, 2020

Filed

vs. sector median

2 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Oregon State AGbd_d704e2e58bc9350f2020-06-03Verified

Name: Grande Ronde Hospital
norm: grande ronde hospital

Name: Grande Ronde Hospital
norm: grande ronde hospital
Industry: Healthcarellm

Discovered: Mar 20, 2020
Breach occurred: Feb 18, 2020
Undetected for: 31 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 3, 2020
Affected individuals: 4state-resident count only
Data types: Identity (basic)Government IDFinancial
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain CompromiseT1078 Valid Accounts
Threat actor: ExternalFinancial
Third party: via PaperlessPay Corporation
Initial access: valid_credentials

During the incident: Arranged for a complimentary one-year membership of Experian IdentityWorksSM Credit 3B for all potentially impacted employees
Worked with PaperlessPay to obtain additional information regarding the incident
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 11 weeks(75 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Oregon State AGJun 3 · first

Montana State AGJun 3 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-97.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 3, 2020
Raw hash: 4d57498f51360500308aeadd24f24dfb09f3212720242acf5026ee3364eca73a

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityGrande Ronde Hospital

Victim entityGrande Ronde Hospital

Incidentdiscovered Mar 20, 2020

Stated responseArranged for a complimentary one-year membership of Experian IdentityWorksSM Credit 3B for all potentially impacted employees

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov