HackingHealthcareHealthcareCustomer Data InvolvedPHIHealth (basic)Identity (basic)LowContained

Indian Health Council Inc.

bd_30eaf0eab626a1e4 · schema v1 · pii pii-v1

Severity

Low

Discovered

Sep 22, 2020

Filed

Nov 20, 2020

To disclose

8 weeks

Affected

Not disclosed

Linked

3 filings

Confidence

65%

Full breach record for Indian Health Council Inc. →

Indian Health Council Inc. experienced a data security incident on September 22, 2020, where an unauthorized actor gained access to servers containing protected health information (PHI), including names, dates of birth, health information, and health insurance information. The organization engaged forensic investigators, implemented multi-factor authentication, and changed passwords. Affected residents of California, Kentucky, Maryland, New Mexico, New York, North Carolina, Oregon, and Rhode Island were notified.

J jump to incidentP pin to compareR raw source

California clockDiscovered Sep 22, 2020 → Notified Nov 20, 202059d ✓ CA 60-day OK8 weeks discovery → filing

Incident timeline

discovery → filing · 8 weeks / 59 days

Sep 22, 2020

Begins

Sep 22, 2020

Discovered

Nov 20, 2020

Filed

vs. sector median

4 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Montana State AGbd_5719ffcd3e101da52020-11-20Candidate
HHS OCRbd_61a336a328adc8712020-11-20Verified by operator

Name: Indian Health Council Inc.
norm: indian health council

Name: Indian Health Council Inc.
norm: indian health council
Industry: Healthcarellm

Discovered: Sep 22, 2020
Breach occurred: Sep 22, 2020
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 20, 2020
Affected individuals: Not disclosed
Data types: PHIHealth (basic)Identity (basic)
Attack vector: Unknown
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External

During the incident: Immediately began an internal investigation
Hired independent computer forensic investigators
Put additional controls in place for any type of remote access to our systems
Changed all impacted passwords
Implemented multi-factor authentication
Changes made: Put additional controls in place for any type of remote access to our systems
Changed all impacted passwords
Implemented multi-factor authentication
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(59 days from discovery to filing)
Compliance flags: CA 60-day OK · 59d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Sep 22, 2020
→ Notified: Nov 20, 2020
59d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Sep 22, 2020 → Notified: Nov 20, 2020	59d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 2 states

View merged incident ↗

Montana State AGNov 20 · first

HHS OCRNov 20 · first

California State AGNov 20 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-196391
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 20, 2020
Raw hash: 3bebdce3852b0e6b05ad5a6a2f227f4e06f967e8c9c865eb6c3b21d1737a888a

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityIndian Health Council Inc.

Victim entityIndian Health Council Inc.

Incidentdiscovered Sep 22, 2020

Stated responseImmediately began an internal investigation

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov