HackingHealthcareHealthcareVulnerability ExploitSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedPHIGovernment IDIdentity (basic)Health (basic)MediumContained

Sutter Senior Care PACE

bd_21791ec6387ec632 · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 31, 2023

Filed

Jul 22, 2023

To disclose

7 weeks

Affected

Not disclosed

Confidence

66%

Full breach record for Sutter Senior Care PACE →

Sutter Senior Care PACE notified residents of a data breach involving their vendor, Cognisight, LLC. Cognisight was impacted by the global MOVEit exploit. On May 31, 2023, Sutter Senior Care learned of the incident. Forensic investigation confirmed files were taken from the MOVEit server. Affected data includes names, dates of birth, SSNs, and health information. Credit monitoring was provided.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 3 days

discovery → filing · 7 weeks / 52 days

May 28, 2023

Begins

May 31, 2023

Discovered

Jul 22, 2023

Filed

vs. sector median

4 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: Sutter Senior Care PACE
norm: sutter senior care pace

Name: Sutter Senior Care PACE
norm: sutter senior care pace
Industry: Healthcarellm

Discovered: May 31, 2023
Breach occurred: May 28, 2023
Undetected for: 3 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: PHIGovernment IDIdentity (basic)Health (basic)
Data elements: Social Security numberDate of birthMedical information
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1195 Supply Chain CompromiseT1041 Exfiltration Over C2 Channel
Threat actor: External
Third party: via Cognisight, LLC
Initial access: exploit_public_facing

During the incident: Stopped access to MOVEit
Had a forensic investigation conducted
Notified Sutter Senior Care
Worked with a vendor to review files for personal information
Securely restored servers from backups
Applied the patch provided by the MOVEit software provider, Progress
Arranged for credit monitoring and identity protection services at no cost
Changes made: Applied the patch provided by the MOVEit software provider, Progress
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 weeks(52 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-570696
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 22, 2023
Raw hash: 47657170e451927850a97f6065513fcac41e2d1854c9404bc8cc0ca83c4ea381

Reporting entitySutter Senior Care PACE

Victim entitySutter Senior Care PACE

Incidentdiscovered May 31, 2023

Stated responseStopped access to MOVEit

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov