Social EngineeringHealthcareHealthcarePhishingStolen CredentialsCustomer Data InvolvedTargetedPHIHealth (basic)Government IDIdentity (basic)HighContained

Northwest Asthma and Allergy Center

bd_3357a6a9046824de · schema v1 · pii pii-v1

Severity

High

Discovered

Nov 13, 2024

Filed

Jan 10, 2025

To disclose

8 weeks

Affected

39,342state residents only

Confidence

69%

Full breach record for Northwest Asthma and Allergy Center →2 incidents on file

Northwest Asthma & Allergy Center (WA) notified the AG of a phishing incident on 2024-11-13. Unauthorized access to an employee email account exposed PHI including names, SSNs, birthdates, and treatment records for 39,342 Washington residents. Notifications began 2024-12-11. Remediation included MFA enforcement and security training.

J jump to incidentP pin to compareR raw source

Washington clock⏱ WA AG >30d8 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 1 days

discovery → filing · 8 weeks / 58 days

Nov 12, 2024

Begins

Nov 13, 2024

Discovered

Jan 10, 2025

Filed

vs. sector median

4 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed39,342 affectedView incident

Name: Northwest Asthma and Allergy Center
norm: northwest asthma and allergy center

Name: Northwest Asthma and Allergy Center
norm: northwest asthma and allergy center
Industry: Healthcarellm

Discovered: Nov 13, 2024
Breach occurred: Nov 12, 2024 – Nov 13, 2024
Undetected for: 1 dayoccurrence → discovery
Materiality determined: —
Notification sent: Dec 11, 2024
Affected individuals: 39,342state-resident count only
Data types: PHIHealth (basic)Government IDIdentity (basic)
Data elements: NameSocial Security numberDriver's licence numberDate of birthHealth insurance IDMedical information
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 1-99dexposure 1-99d
WA-stated discovery: Found while ongoingContained same day
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Regulator citations: Notified Washington Attorney General Bob Ferguson
Initial access: phishing_link

During the incident: Engaged third-party IT support and security partner Praece for comprehensive investigation
Moved quickly to investigate and respond to the event
Conducted a forensic investigation to determine the nature and scope of the event
Sifted through affected staff's email to determine what data may have been compromised
Ensured that all staff are being compliant with MFA
Added additional Security Trainings to provide guidance on how to better protect against the newest types of identity theft and fraud
Included information on how to place a fraud alert and a security freeze on one’s credit file in letters to affected patients
Provided contact details for the 3 major national consumer reporting agencies
Engaged outside experts to conduct a thorough review of our security measures
Changes made: Ensured that all staff are being compliant with MFA
Added additional Security Trainings to provide guidance on how to better protect against the newest types of identity theft and fraud
Engaged outside experts to conduct a thorough review of our security measures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(58 days from discovery to filing)
Compliance flags: WA AG >30d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA31894.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 10, 2025
Raw hash: b7537c1637bc4d5a9b2f41d30d8b35a9b890968ace9e8a88a9f918f066f4db16

Reporting entityNorthwest Asthma and Allergy Center

Victim entityNorthwest Asthma and Allergy Center

Incidentdiscovered Nov 13, 2024

Stated responseEngaged third-party IT support and security partner Praece for comprehensive investigation

ComplianceWA AG >30d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com