MalwareRansomwareSupply Chain (3P Vendor)Data ExfiltratedRansom DemandedRansom PaidData EncryptedTargetedIDENTITY_BASICIDENTITY_GOVERNMENTHEALTH_BASICMediumContained
Northern Light Health
bd_156bbc26a4650128 · schema v1 · pii pii-v1
Full breach record for Northern Light Health →Northern Light Health, a healthcare provider, notified affected individuals of a ransomware attack on third-party vendor Blackbaud, Inc. occurring in May 2020. The incident exposed limited protected health information (PHI), names, addresses, dates of birth, and gender for 487 Rhode Island residents. Northern Light Health investigated, notified HHS, and is reviewing vendor policies.
California clockDiscovered Jul 16, 2020 → Notified Jul 16, 20200d ✓ CA 60-day OK9 weeks discovery → filing
⚠ notification dateThe stored discovery date equals the NOTIFICATION date, collapsing the clock to ~zero. This UNDERSTATES the delay and can mask a real violation.
This filing is one of 2 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (1) · sorted by filing gap
- bd_da2fefd7ae757080Montana State AGfiled 2020-09-14Candidate
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-194021
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Sep 14, 2020
- Raw hash
- 97e281b6e240fb8706ddff8dc2c5315ba9073e6f644c26897eedd11d902a2796
Reporting entity
- Name
- Northern Light Healthnorm: northern light health
- Domain
- northernlighthealth.org
Victim entity
- Name
- Northern Light Healthnorm: northern light health
- Domain
- northernlighthealth.org
Incident
- Discovered
- Jul 16, 2020
- Materiality determined
- —
- Notification sent
- Jul 16, 2020
- Affected individuals
- 487
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENTHEALTH_BASIC
- Attack vector
- Ransomware
- MITRE ATT&CK
- T1486 Data Encrypted for ImpactT1195 Supply Chain Compromise
- Threat actor
- ExternalFinancial
- Regulator citations
- Provided the legally required notification of this incident to the United States Department of Health and Human Services
- Third party
- via Blackbaud, Inc.
- Initial access
- supply_chain
Compliance
- Time to disclose
- 9 weeks(60 days from discovery to filing)
- Compliance flags
- CA 60-day OK · 0d
- Discovery-date grounding
- notification dateThe stored discovery date equals the NOTIFICATION date, collapsing the clock to ~zero. This UNDERSTATES the delay and can mask a real violation.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Jul 16, 2020→ Notified: Jul 16, 20200d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.