Social EngineeringHealthcareHealthcarePhishingStolen CredentialsData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDHealth (basic)Financial accountHighContained

Western Montana Clinic

bd_2bbdd83ea2ffc91c · schema v1 · pii pii-v1

Severity

High

Discovered

Apr 15, 2025

Filed

Aug 1, 2025

To disclose

15 weeks

Affected

8,829state residents only

Linked

2 filings

Confidence

65%

Full breach record for Western Montana Clinic →2 incidents on file

Western Montana Clinic PC notified patients of a phishing incident where unauthorized access to employee email accounts occurred between March 11 and April 15, 2025. The actor accessed emails containing patient PII (SSN, DOB, contact info) and PHI. The clinic engaged third-party experts, performed a data review, and offered 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 35 days

discovery → filing · 15 weeks / 108 days

Mar 11, 2025

Begins

Apr 15, 2025

Discovered

Aug 1, 2025

Filed

vs. sector median

+6 wks slower

This filing is one of 2 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

HHS OCRbd_04cf631e08accb012025-08-01Verified

Name: Western Montana Clinic
norm: western montana clinic

Name: Western Montana Clinic
norm: western montana clinic
Industry: Healthcarellm

Discovered: Apr 15, 2025
Breach occurred: Mar 11, 2025 – Apr 15, 2025
Undetected for: 35 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 8,829state-resident count only
Data types: Identity (basic)Government IDHealth (basic)Financial account
Data elements: Social Security numberDate of birth
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Initial access: phishing_link

During the incident: Began an investigation
Worked with third-party experts to contain and remediate the issue
Performed a data review
Offering a 12-month membership of Experian’s IdentityWorks SM Credit 3B free of charge
Changes made: Continue to implement and evaluate enhanced safeguards and security measures to further protect our email system
Continue to provide training to our employees regarding phishing emails
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 15 weeks(108 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings

View merged incident ↗

HHS OCRAug 1 · first

Montana State AGAug 1 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/2025/08/Consumer-notification-letter-14.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 1, 2025
Raw hash: 7e7c278297aea51d5c1841832cdc440c2d6a2ae51500a0da0c2ba923537ac366

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityWestern Montana Clinic

Victim entityWestern Montana Clinic

Incidentdiscovered Apr 15, 2025

Stated responseBegan an investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov