HackingHealthcareHealthcareStolen CredentialsCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDPHIHealth (basic)Financial accountMediumContained

Three Rivers Provider Network

bd_1135fa5e115212d4 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 3, 2022

Filed

Jul 21, 2023

To disclose

14 months

Affected

Not disclosed

Linked

3 filings

Confidence

65%

Full breach record for Three Rivers Provider Network →2 incidents on file

Three Rivers Provider Network identified unauthorized access to an employee email account on June 3, 2022. The breach, which occurred on June 2, 2022, potentially exposed personal information including names, addresses, SSNs, and protected health information (PHI) such as treatment and diagnosis data. The company secured the account and is offering credit monitoring.

J jump to incidentP pin to compareR raw source

California clockDiscovered Jun 3, 2022 → Notified Oct 15, 2022134d ✗ CA 60-day late14 months discovery → filing

Incident timeline

undetected · 1 days

discovery → filing · 14 months / 413 days

Jun 2, 2022

Begins

Jun 3, 2022

Discovered

Jul 21, 2023

Filed

vs. sector median

+48 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Maine State AGbd_462f0f4c5aee53c82023-07-21Verified
New Hampshire State AGbd_b43d57a3b1062d1d2023-07-28 · +7dVerified

Name: Three Rivers Provider Network
norm: three rivers provider network

Name: Three Rivers Provider Network
norm: three rivers provider network
Industry: Healthcarellm

Discovered: Jun 3, 2022
Breach occurred: Jun 2, 2022
Undetected for: 1 dayoccurrence → discovery
Materiality determined: —
Notification sent: Oct 15, 2022
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDPHIHealth (basic)Financial account
Data elements: Social Security numberDate of birthMedical information
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: External
Initial access: valid_credentials

During the incident: Initiated an investigation
Secured the compromised account
Taken additional steps to secure our systems
Offering credit monitoring services
Changes made: Taken additional steps to secure our systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 14 months(413 days from discovery to filing)
Compliance flags: CA 60-day late · 134d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Jun 3, 2022
→ Notified: Oct 15, 2022
134d 60 days (analyst band, pre-2026 discoveries) CA 60-day late

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Jun 3, 2022 → Notified: Oct 15, 2022	134d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Maine State AGJul 21 · first

California State AGJul 21 · first · this page

New Hampshire State AG+7d

Pattern: first filing Jul 21 (ME), last Jul 28 (NH) — a 7-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-570682
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 21, 2023
Raw hash: e66ec3d74ff5234c9ec18d7558f96eb2184b1c72f71b25fdcdb596654a15e464

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityThree Rivers Provider Network

Victim entityThree Rivers Provider Network

Incidentdiscovered Jun 3, 2022

Stated responseInitiated an investigation

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov