Social EngineeringHealthcareHealthcarePhishingStolen CredentialsCustomer Data InvolvedEmployee Data InvolvedPIIIdentity (basic)Government IDFinancial accountCredentialsMediumContained

NCH Healthcare System, Inc.

bd_1051a70a9ed25aba · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 14, 2019

Filed

Feb 14, 2020

To disclose

35 weeks

Affected

3state residents only

Linked

5 filings

Confidence

66%

Full breach record for NCH Healthcare System, Inc. →2 incidents on file

NCH Healthcare System notified employees of a phishing attack on June 14, 2019, which compromised payroll and email accounts. Attackers rerouted direct deposits and accessed emails. Affected data included PII, SSNs, and financial info. NCH engaged forensic investigators, secured systems, and offered two years of credit monitoring. No patient records were affected.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 35 weeks / 245 days

Jun 14, 2019

Discovered

Feb 14, 2020

Filed

vs. sector median

+22 wks slower

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Massachusetts State AGbd_5dc07e0b87c044892020-02-14Verified
Indiana State AGbd_d9063a144f3778d22020-02-14Verified
HHS OCRbd_21104c6e1b77b69f2020-02-17 · +3dVerified
Illinois State AGbd_b9de189adedc7c892020-01-01 · +44dCandidate

Name: NCH Healthcare System, Inc.
norm: nch healthcare system

Name: NCH Healthcare System, Inc.
norm: nch healthcare system
Industry: Healthcarellm

Discovered: Jun 14, 2019
Materiality determined: —
Notification sent: Feb 14, 2020
Affected individuals: 3state-resident count only
Data types: PIIIdentity (basic)Government IDFinancial accountCredentials
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Initial access: phishing_link

During the incident: Launched an investigation into suspicious activity
Worked with third-party forensic investigators to confirm the full nature and scope of this event
Took steps to secure our systems
Undertook a diligent and time-consuming manual and programmatic review of the entire contents of the relevant email accounts
Offering you access to two years of credit monitoring and identity theft restoration services through ID Experts at no cost to you
Changes made: Implementing additional safeguards to protect the security of information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 35 weeks(245 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Illinois State AGJan 1 · first

Massachusetts State AG+44d

Indiana State AG+44d

Montana State AG+44d · this page

HHS OCR+47d

Pattern: first filing Jan 1 (IL), last Feb 17 (FL) — a 47-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Breach-NotificationDetails-116.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 14, 2020
Raw hash: 8b28f70bd46bc8a0196b587b619da7adbdb7888fe63cd92dd7e01799fda37875

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityNCH Healthcare System, Inc.

Victim entityNCH Healthcare System, Inc.

Incidentdiscovered Jun 14, 2019

Stated responseLaunched an investigation into suspicious activity

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov