HackingHealthcareHealthcareStolen CredentialsTargetedIdentity (basic)LowContained

Winslow Memorial Hospital

bd_182fc14253920b1f · schema v1 · pii pii-v1

Severity

Low

Discovered

Apr 21, 2022

Filed

May 25, 2023

To disclose

13 months

Affected

1state residents only

Linked

3 filings

Confidence

64%

Full breach record for Winslow Memorial Hospital →2 incidents on file

Winslow Memorial Hospital dba Little Colorado Medical Center notified Montana residents of unauthorized access to systems between March 7 and April 21, 2022. The incident involved an unauthorized individual gaining access, likely via valid credentials. Affected data included names and addresses. The hospital notified law enforcement and is implementing additional security measures.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 45 days

discovery → filing · 13 months / 399 days

Mar 7, 2022

Begins

Apr 21, 2022

Discovered

May 25, 2023

Filed

vs. sector median

+48 wks slower

This filing is one of 3 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_0233bddd7abda5c92023-05-25Verified
Indiana State AGbd_e7662a6d7ed5fb5a2023-05-24 · +1dVerified

Name: Winslow Memorial Hospital
norm: winslow memorial hospital

Name: Winslow Memorial Hospital
norm: winslow memorial hospital
Also named: Winslow Memorial Hospitaldba oflegal entity
Little Colorado Medical Centerdba oftrade name
Industry: Healthcarellm

Discovered: Apr 21, 2022
Breach occurred: Mar 7, 2022 – Apr 21, 2022
Undetected for: 45 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 25, 2023
Affected individuals: 1state-resident count only
Data types: Identity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: notifying regulators as necessary
Initial access: valid_credentials

During the incident: Launched an investigation into the nature and scope of the activity
Undertaken a lengthy and labor-intensive process to identify the information within the affected systems
Notified law enforcement
Notifying regulators as necessary
Changes made: Implementing additional technical security measures to harden their system against future threats
Enhancing existing data privacy policies and procedures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 13 months(399 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Indiana State AGMay 24 · first

Massachusetts State AG+1d

Montana State AG+1d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-notification-letter-315.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 25, 2023
Raw hash: 9331b797f0a88fc8fc4eae0d388b5b4cfe297d75c9dafeb1d38ef0955244912d

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityWinslow Memorial Hospital

Victim entityWinslow Memorial Hospital

Incidentdiscovered Apr 21, 2022

Stated responseLaunched an investigation into the nature and scope of the activity

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov