MalwareHealthcareHealthcareRansomwareSupply Chain (3P Vendor)Data ExfiltratedRansom DemandedRansom PaidCustomer Data InvolvedPHIHealth (basic)Identity (basic)LowContained

Northern Light Health

bd_156bbc26a4650128 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jul 16, 2020

Filed

Sep 14, 2020

To disclose

9 weeks

Affected

Not disclosed

Linked

2 filings

Confidence

65%

Full breach record for Northern Light Health →4 incidents on file

Northern Light Health notified individuals of a ransomware attack on its third-party vendor, Blackbaud, Inc., in May 2020. The attack resulted in the exfiltration of limited protected health information, including names, addresses, dates of birth, and medical service details. Blackbaud paid the ransom. Northern Light Health notified HHS and established a call center for affected individuals.

J jump to incidentP pin to compareR raw source

California clockDiscovered Jul 16, 2020 → Notified Sep 14, 202060d ✓ CA 60-day OK9 weeks discovery → filing

Incident timeline

undetected · 76 days

discovery → filing · 9 weeks / 60 days

May 1, 2020

Begins

Jul 16, 2020

Discovered

Sep 14, 2020

Filed

vs. sector median

4 wks faster

This filing is one of 2 about the same incident.View merged incident

Part of BLACKBAUD, INC. supply-chain incident (2020) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Montana State AGbd_da2fefd7ae7570802020-09-14Candidate

Name: Northern Light Health
norm: northern light health
Domain: northernlighthealth.org

Name: Northern Light Health
norm: northern light health
Domain: northernlighthealth.org
Industry: Healthcarellm

Discovered: Jul 16, 2020
Breach occurred: May 1, 2020 – May 20, 2020
Undetected for: 76 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 14, 2020
Affected individuals: Not disclosed
Data types: PHIHealth (basic)Identity (basic)
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1195 Supply Chain Compromise
Threat actor: ExternalFinancial
Regulator citations: Notified the United States Department of Health and Human Services
Third party: via Blackbaud, Inc.
Initial access: supply_chain

During the incident: Commenced an investigation to better understand the nature and scope of the incident
Working diligently to gather further information from Blackbaud to understand the scope of the incident
Provided the legally required notification of this incident to the United States Department of Health and Human Services
Established a dedicated assistance line at ([REDACTED-PHONE]
Changes made: Reviewing existing policies and procedures regarding third-party vendors
Working with Blackbaud to evaluate additional measures and safeguards to protect against this type of incident in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(60 days from discovery to filing)
Compliance flags: CA 60-day OK · 60d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Jul 16, 2020
→ Notified: Sep 14, 2020
60d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Jul 16, 2020 → Notified: Sep 14, 2020	60d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Montana State AGSep 14 · first

California State AGSep 14 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-194021
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 14, 2020
Raw hash: 97e281b6e240fb8706ddff8dc2c5315ba9073e6f644c26897eedd11d902a2796

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityNorthern Light Health

Victim entityNorthern Light Health

Incidentdiscovered Jul 16, 2020

Stated responseCommenced an investigation to better understand the nature and scope of the incident

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov