HackingHealthcareHealthcareDelayed DiscoveryTargetedIdentity (basic)Government IDHealth (basic)PHIMediumActive

UCLA Health

bd_35a747e70f5a1fbb · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 5, 2015

Filed

Jul 17, 2015

To disclose

10 weeks

Affected

517state residents only

Linked

5 filings

Confidence

66%

UCLA Health notified New Hampshire AG of a cyberattack where attackers accessed the network starting Sept 2014. Discovered May 5, 2015. 517 NH residents potentially impacted. Data at risk included names, SSNs, DOBs, medical info. FBI engaged, forensics experts retained. Identity theft services and credit monitoring offered.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 246 days

discovery → filing · 10 weeks / 73 days

Sep 1, 2014

Begins

May 5, 2015

Discovered

Jul 17, 2015

Filed

vs. sector median

1 wks faster

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

California State AGbd_0c9ea43643627ff02015-07-17Candidate
HHS OCRbd_eef61580e59756ac2015-07-17Verified
Massachusetts State AGbd_a78328bfdfbbe63f2015-07-20 · +3dVerified
Hawaii State AGbd_5ca3b58d29fa8c482015-07-22 · +5dVerified

Name: UCLA Health
norm: ucla health
Domain: uclahealth.org

Name: UCLA Health
norm: ucla health
Domain: uclahealth.org
Industry: Healthcarellm

Discovered: May 5, 2015
Breach occurred: Sep 1, 2014
Undetected for: 246 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 17, 2015
Affected individuals: 517state-resident count only
Data types: Identity (basic)Government IDHealth (basic)PHI
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: External
Regulator citations: Notified and working with the Federal Bureau of Investigation

During the incident: Notified and working with the Federal Bureau of Investigation
Investigating the attack with help from third-party computer forensics experts
Making available 12 months of complete identity theft recovery and restoration services
Making available a $1,000,000 insurance reimbursement policy
Making available additional healthcare identity protection tools through ID Experts
Providing 12 months of credit monitoring for individuals whose SSN or Medicare ID was stored
Changes made: Taking additional steps to protect data
Made modifications to the UCLA Health network to help protect against another cyberattack
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 10 weeks(73 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 4 states

View merged incident ↗

California State AGJul 17 · first

HHS OCRJul 17 · first

New Hampshire State AGJul 17 · first · this page

Massachusetts State AG+3d

Hawaii State AG+5d

Pattern: first filing Jul 17 (CA), last Jul 22 (HI) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/ucla-health-20150717.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 17, 2015
Raw hash: 710d1651130ec588081574e212c78bf07d291b9558c19851a1210eb48dce3f5d

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityUCLA Health

Victim entityUCLA Health

Incidentdiscovered May 5, 2015

Stated responseNotified and working with the Federal Bureau of Investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov