HackingHealthcareHealthcareStolen CredentialsCapture App DataCustomer Data InvolvedEmployee Data InvolvedPIIPHIIdentity (basic)Health (basic)LowContained

Salinas Valley Memorial Healthcare System

bd_365713df4ac39cb2 · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Jul 29, 2020

To disclose

—

Affected

Not disclosed

Linked

3 filings

Confidence

80%

Full breach record for Salinas Valley Memorial Healthcare System →

Salinas Valley Memorial Healthcare System (SVMHS) experienced unauthorized access to email accounts of one employee and a contractor plus three other employees via Outlook Web Access between April and May 2020. The compromised inboxes may have contained patient names, hospital/medical record numbers, service location, and attending physician information. SVMHS disabled accounts, reset passwords, and implemented two-factor authentication. HHS OCR, California AG, and California DPH were notified.

J jump to incidentP pin to compareR raw source

Incident timeline

Apr 24, 2020

Begins

Jul 29, 2020

Filed

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

HHS OCRbd_1ec6334de7840e172020-06-29 · +30dVerified
California State AGbd_f3a47a46665d2ac72020-06-29 · +30dVerified

Name: Salinas Valley Memorial Healthcare System
norm: salinas valley memorial healthcare system

Name: Salinas Valley Memorial Healthcare System
norm: salinas valley memorial healthcare system
Industry: Healthcarellm

Discovered: —
Breach occurred: Apr 24, 2020 – May 7, 2020
Materiality determined: —
Notification sent: Jul 29, 2020
Affected individuals: Not disclosed
Data types: PIIPHIIdentity (basic)Health (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: External
Regulator citations: Notified the California Department of Public HealthNotified the California Attorney GeneralNotified the U.S. Department of Health and Human Services Office for Civil Rights
Initial access: valid_credentials

During the incident: Disabled access to the affected email accounts
Reset the passwords to the affected email accounts
Implemented two-factor authentication to Outlook Web Access for all SVMHS email accounts
Partnering with Experian to provide Experian IdentityWorks product for one year at no charge to affected individuals
Changes made: Implemented additional security measures such as two-factor authentication to Outlook Web Access for all SVMHS email accounts
Taken other steps to try to prevent similar incidents in the future
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings

View merged incident ↗

HHS OCRJun 29 · first

California State AGJun 29 · first

California State AG+30d · this page

Pattern: first filing Jun 29 (CA), last Jul 29 (CA) — a 30-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-192562
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 29, 2020
Raw hash: 79ed146a89fc13405bc0817ee933cd8d374780acfa2c4859d1a557b364eb4adb

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entitySalinas Valley Memorial Healthcare System

Victim entitySalinas Valley Memorial Healthcare System

IncidentUnauthorized Access

Stated responseDisabled access to the affected email accounts

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov