MalwareHealthcareHealthcareRansomwareData ExfiltratedData EncryptedCustomer Data InvolvedIdentity (basic)Government IDHealth (basic)PHIHighContained

One Community Health

bd_35ad13c84ba11aa9 · schema v1 · pii pii-v1

Severity

High

Discovered

Apr 20, 2021

Filed

Nov 22, 2021

To disclose

31 weeks

Affected

7,945state residents only

Linked

7 filings

Confidence

71%

Full breach record for One Community Health →2 incidents on file

One Community Health reported a ransomware attack occurring April 19-20, 2021, affecting 7,945 Washington residents. PHI and PII (SSN, DOB, DL) were exfiltrated. Notification sent Nov 22, 2021. Remediation included enhanced cybersecurity defenses and credit monitoring offers.

J jump to incidentP pin to compareR raw source

Washington clock✗ WA AG >90d31 weeks discovery → filing

Incident timeline

undetected · 1 days

discovery → filing · 31 weeks / 216 days

Apr 19, 2021

Begins

Apr 20, 2021

Discovered

Nov 22, 2021

Filed

vs. sector median

+18 wks slower

This filing is one of 7 about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitepysabd_bec32e8ec6b2f2d52021-09-13 · +70dVerified by operator

Regulatory filings (5) · sorted by filing gap

California State AGbd_263ec385e615791b2021-11-22Candidate
Massachusetts State AGbd_3160c106a12e74b62021-11-22Verified
Oregon State AGbd_649bee50f83e02db2021-11-22Verified
HHS OCRbd_7192441b0b10f5ef2021-11-22Verified

Show 1 more filing ↓

Montana State AGbd_e0a5b3d61a15dd392021-11-22Verified

Name: One Community Health
norm: one community health

Name: One Community Health
norm: one community health
Industry: Healthcarellm

Discovered: Apr 20, 2021
Breach occurred: Apr 19, 2021 – Apr 20, 2021
Undetected for: 1 dayoccurrence → discovery
Materiality determined: —
Notification sent: Nov 22, 2021
Affected individuals: 7,945state-resident count only
Data types: Identity (basic)Government IDHealth (basic)PHI
Data elements: NameSocial Security numberDriver's licence numberDate of birthHealth insurance IDMedical information
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 1-99dexposure 1-99d
WA-stated discovery: Found while ongoing
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notice is also being provided pursuant to the HIPAA Breach Notification Rule

During the incident: Launched an investigation in consultation with outside cybersecurity professionals
Conducted an extensive forensic investigation and manual document review
Providing the affected residents with written notification
Offering the affected residents whose Social Security number was impacted complimentary one-year memberships with a credit monitoring service
Changes made: Partnered with cybersecurity experts to significantly increase its cybersecurity defenses
Improved endpoint detection
24X7 managed detection and response
Email and attachment security enhancements
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 31 weeks(216 days from discovery to filing)
Compliance flags: WA AG >90dLeak >30d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 5 states

View merged incident ↗

California State AGNov 22 · first

Massachusetts State AGNov 22 · first

Oregon State AGNov 22 · first

HHS OCRNov 22 · first

Montana State AGNov 22 · first

Washington State AGNov 22 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA3182.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 22, 2021
Raw hash: 2872f366ad57780a37daa33497a83e8ce234e7815c15ae895e1587e87fcf4418

Linked disclosures

Ransomware claims (1)

Regulatory filings (5) · sorted by filing gap

Reporting entityOne Community Health

Victim entityOne Community Health

Incidentdiscovered Apr 20, 2021

Stated responseLaunched an investigation in consultation with outside cybersecurity professionals

ComplianceWA AG >90d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com