HackingStolen CredentialsSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedIDENTITY_BASICIDENTITY_GOVERNMENTHEALTH_BASICMediumContained
Providence Saint John's Health Center
bd_2e4a06186cd097aa · schema v1 · pii pii-v1
Full breach record for Providence Saint John's Health Center →Providence Saint John's Health Center reported a breach involving vendor Nuance Communications, Inc. on December 8, 2017. Nuance experienced unauthorized intrusion, resulting in the theft of patient personal information including names, DOBs, SSNs, and medical records. Nuance took the system offline and worked with law enforcement, who recovered the data. Providence delayed notification per law enforcement request but sent notices in May 2018 offering credit monitoring.
California clockDiscovered Dec 27, 2017 → Notified May 11, 2018135d ✗ CA 60-day late20 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-136250
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- May 16, 2018
- Raw hash
- 23bdb74fa30288cafd9216681fa5dcf79d8c2f643751ef94bbfe23180baf03f2
Reporting entity
- Name
- Providence Saint John's Health Centernorm: providence saint john s health center
Victim entity
- Name
- Providence Saint John's Health Centernorm: providence saint john s health center
Incident
- Discovered
- Dec 27, 2017
- Materiality determined
- —
- Notification sent
- May 11, 2018
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENTHEALTH_BASIC
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1195 Supply Chain Compromise
- Threat actor
- ExternalFinancial
- Regulator citations
- Law enforcement recovered the breached information during their investigation
- Third party
- via Nuance Communications, Inc.
- Initial access
- supply_chain
Compliance
- Time to disclose
- 20 weeks(140 days from discovery to filing)
- Compliance flags
- CA 60-day late · 135d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Dec 27, 2017→ Notified: May 11, 2018135d 60 days (analyst band, pre-2026 discoveries) CA 60-day late
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.