HackingHealthcareHealthcareStolen CredentialsSupply Chain (3P Vendor)Employee Data InvolvedIdentity (basic)Government IDFinancial accountEmploymentMediumContained

Emanate Health Foundation

bd_15f2b13805246ff4 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 19, 2020

Filed

Jul 29, 2020

To disclose

23 weeks

Affected

Not disclosed

Linked

3 filings

Confidence

65%

Full breach record for Emanate Health Foundation →2 incidents on file

Emanate Health notified employees of a data breach involving third-party vendor PaperlessPay Corporation. An unauthorized individual accessed PaperlessPay's SQL server on February 18, 2020, potentially viewing employee data including names, addresses, Social Security numbers, and partial bank account numbers. PaperlessPay discovered the incident on February 19, 2020, after DHS contact. The vendor shut down servers, cooperated with DHS/FBI, and rebuilt infrastructure. Emanate Health offered 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 1 days

discovery → filing · 23 weeks / 161 days

Feb 18, 2020

Begins

Feb 19, 2020

Discovered

Jul 29, 2020

Filed

vs. sector median

+10 wks slower

This filing is one of 3 about the same incident.View merged incident

Part of PaperlessPay Corporation supply-chain incident (2020) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Indiana State AGbd_bbce687257723db42020-07-29Verified
Massachusetts State AGbd_6fcbe7dea53a0de12020-07-31 · +2dVerified

Name: Emanate Health Foundation
norm: emanate health

Name: Emanate Health Foundation
norm: emanate health
Industry: Healthcarellm

Discovered: Feb 19, 2020
Breach occurred: Feb 18, 2020
Undetected for: 1 dayoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDFinancial accountEmployment
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Department of Homeland Security (“DHS”) contacted PaperlessPayFederal Bureau of Investigation (“FBI”) conducted joint investigation
Third party: via PaperlessPay Corporation

During the incident: PaperlessPay shut down its web server and Structured Query Language (“SQL”) server to prevent any potential unauthorized access
PaperlessPay cooperated with a joint investigation conducted by DHS and the Federal Bureau of Investigation (“FBI”)
PaperlessPay retained a cybersecurity firm to help with its internal forensic investigation of the incident
Emanate Health has been working with PaperlessPay to obtain details of the incident and the affected accounts and to obtain assurances that information about our employees is safe
Emanate Health is offering free credit monitoring services for 12 months
Changes made: PaperlessPay has rebuilt an entirely new domain controller, a new web server, and a new SQL server
PaperlessPay restored database files to the new SQL server from backups
PaperlessPay assigned new IP addresses to all of the new servers
PaperlessPay changed all passwords for users and administrators
PaperlessPay implemented a setting that requires clients to change their passwords when they login for the first time
PaperlessPay disabled all remote access capabilities to the new web server and SQL server
PaperlessPay installed an endpoint detection and response application on the new servers and other endpoints within its network
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 23 weeks(161 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Indiana State AGJul 29 · first

California State AGJul 29 · first · this page

Massachusetts State AG+2d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-192529
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 29, 2020
Raw hash: 2cbe5919dd4dd355ab7c8e26e4bcd247fcf9ebdcb02a1ccae17e0e4c4d68b0d1

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityEmanate Health Foundation

Victim entityEmanate Health Foundation

Incidentdiscovered Feb 19, 2020

Stated responsePaperlessPay shut down its web server and Structured Query Language (“SQL”) server to prevent any potential unauthorized access

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov