HackingHealthcareProfessional ServicesHealthcareStolen CredentialsSupply Chain (3P Vendor)Employee Data InvolvedIdentity (basic)Government IDFinancialEmploymentMediumContained

Phoenix House Foundation, Inc. and its affiliates

bd_348fb33d632cb30e · schema v1 · pii pii-v1

Severity

Medium

Discovered

Dec 22, 2014

Filed

Feb 5, 2015

To disclose

6 weeks

Affected

Not disclosed

Linked

3 filings

Confidence

64%

Full breach record for Phoenix House Foundation, Inc. and its affiliates →

Phoenix House Foundation, Inc. and its affiliates notified individuals that a third-party payroll consultant made unauthorized changes to electronic payroll systems on December 19, 2014. The company discovered the activity on December 22, 2014. Affected data includes names, addresses, Social Security numbers, salary, and benefit information for current and former employees. The consultant's access was removed, the contract terminated, and law enforcement notified. A comprehensive security review is underway.

J jump to incidentP pin to compareR raw source

California clockDiscovered Dec 22, 2014 → Notified Feb 4, 201544d ✓ CA 60-day OK6 weeks discovery → filing

Incident timeline

undetected · 3 days

discovery → filing · 6 weeks / 45 days

Dec 19, 2014

Begins

Dec 22, 2014

Discovered

Feb 5, 2015

Filed

vs. sector median

6 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

New Hampshire State AGbd_a31f26cc4baadc4c2015-02-05Verified
Massachusetts State AGbd_36ae74a84ff62e1e2015-02-06 · +1dVerified

Name: Phoenix House Foundation, Inc. and its affiliates
norm: phoenix house foundation inc and its affiliates

Name: Phoenix House Foundation, Inc. and its affiliates
norm: phoenix house foundation inc and its affiliates
Industry: HealthcarellmProfessional Servicesllm

Discovered: Dec 22, 2014
Breach occurred: Dec 19, 2014
Undetected for: 3 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 4, 2015
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDFinancialEmployment
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: Partner
Regulator citations: Reported the incident to law enforcement
Third party: via Payroll Service Provider
Initial access: trusted_relationship

During the incident: Removed the consultant's access to the systems at issue
Conducted an investigation to determine what information may have been changed
Terminated the consultant's contract
Reported the incident to law enforcement
Cooperating with law enforcement in its investigation of this incident
Working to restore the information to its state before the incident
Updating the files for authorized changes that have occurred since the incident
Changes made: Conducting a comprehensive review of our information security practices and procedures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(45 days from discovery to filing)
Compliance flags: CA 60-day OK · 44d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Dec 22, 2014
→ Notified: Feb 4, 2015
44d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Dec 22, 2014 → Notified: Feb 4, 2015	44d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

New Hampshire State AGFeb 5 · first

California State AGFeb 5 · first · this page

Massachusetts State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-48355
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 5, 2015
Raw hash: 518b17998a7ec0a53508f09094e58763d351fa5c97d478fd13f637dbe9fb86f4

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityPhoenix House Foundation, Inc. and its affiliates

Victim entityPhoenix House Foundation, Inc. and its affiliates

Incidentdiscovered Dec 22, 2014

Stated responseRemoved the consultant's access to the systems at issue

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov