HackingHealthcareHealthcareStolen CredentialsData ExfiltratedCustomer Data InvolvedEmployee Data InvolvedGovernment IDIdentity (basic)Financial accountMediumContained

SUTTER HEALTH

bd_21b3327b6dd8ac94 · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Jun 6, 2013

To disclose

—

Affected

Not disclosed

Confidence

64%

Full breach record for SUTTER HEALTH →3 incidents on file

Sutter Health East Bay Region reported a cybersecurity incident involving unauthorized access to its systems. The breach compromised patient and employee data, including government IDs, names, and financial account numbers. The organization engaged forensic investigators and law enforcement, reset credentials, and implemented enhanced security measures.

J jump to incidentP pin to compareR raw source

Incident timeline — partial

? — ?

Breach window not drawn

Jun 6, 2013

Filed

No interval is drawn: the breach start date on record falls after this filing's date.

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: SUTTER HEALTH
norm: sutter health
Domain: sutterhealth.org

Name: SUTTER HEALTH
norm: sutter health
Domain: sutterhealth.org
Industry: Healthcarellm

Discovered: —
Breach occurred: Sep 16, 2024
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Government IDIdentity (basic)Financial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: ExternalFinancial
Initial access: valid_credentials

During the incident: Engaged third-party forensic investigators
Notified law enforcement (FBI)
Reset affected user credentials
Disabled compromised accounts
Implemented additional security monitoring
Changes made: Implemented multi-factor authentication (MFA)
Enhanced security awareness training
Reviewed and strengthened access controls
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-41933
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 6, 2013
Raw hash: c67269e8d5fbabf4b4f5f6d06cf8353a4f4e7792ba7d5533d6978e0be75a25ac

Reporting entitySUTTER HEALTH

Victim entitySUTTER HEALTH

IncidentUnauthorized Access

Stated responseEngaged third-party forensic investigators

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov