MalwareHealthcareHealthcareRansomwareData EncryptedTargetedPHIHealth (basic)Identity (basic)LowContained

Sonoma Valley Hospital

bd_26a8ae0667f4e68c · schema v1 · pii pii-v1

Severity

Low

Discovered

Oct 11, 2020

Filed

Dec 11, 2020

To disclose

9 weeks

Affected

45state residents only

Linked

4 records

Confidence

65%

Full breach record for Sonoma Valley Hospital →2 incidents on file

Sonoma Valley Hospital suffered a ransomware attack on October 11, 2020, believed to be conducted by a Russian threat actor. The incident resulted in the potential disclosure of patient health information, including names, addresses, birthdates, and diagnosis codes. The hospital shut down systems, engaged forensic experts, and notified law enforcement.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 9 weeks / 61 days

Oct 11, 2020

Begins

Oct 11, 2020

Discovered

Dec 11, 2020

Filed

vs. sector median

on median

This filing is one of 4 records about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Siteryukbd_d5c0b92a97b9e8c72020-10-11 · +61dVerified

Regulatory filings (2) · sorted by filing gap

Oregon State AGbd_998c2c215de23dc22020-12-11Verified by operator
California State AGbd_042d879cab2d30db2020-12-09 · +2dVerified

Name: Sonoma Valley Hospital
norm: sonoma valley hospital
Domain: svh.com

Name: Sonoma Valley Hospital
norm: sonoma valley hospital
Domain: svh.com
Industry: Healthcarellm

Discovered: Oct 11, 2020
Breach occurred: Oct 11, 2020
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 45state-resident count only
Data types: PHIHealth (basic)Identity (basic)
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: notified law enforcement

During the incident: Shutting down all systems to contain the damage
Notified law enforcement of the incident
Engaged a leading external cybersecurity firm to assess the potential disclosure of protected health information
Expelled them from our system
Changes made: Activated a series of enhanced security measures to improve information security and prevent further ransomware or cybersecurity attacks
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(61 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

California State AGDec 9 · first

Oregon State AG+2d

Montana State AG+2d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/sonomaSamp.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 11, 2020
Raw hash: 1e5fcfc92e4bb23b7bcab8cb6e51b644dd9366c70086ef2f05627fdde510aef2

Linked disclosures

Ransomware claims (1)

Regulatory filings (2) · sorted by filing gap

Reporting entitySonoma Valley Hospital

Victim entitySonoma Valley Hospital

Incidentdiscovered Oct 11, 2020

Stated responseShutting down all systems to contain the damage

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov