Social EngineeringHealthcareHealthcarePhishingStolen CredentialsCustomer Data InvolvedTargetedPIIIdentity (basic)LowContained

South Country Health Alliance

bd_36c5cca26316281f · schema v1 · pii pii-v1

Severity

Low

Discovered

Sep 14, 2020

Filed

Dec 30, 2020

To disclose

15 weeks

Affected

20state residents only

Linked

6 filings

Confidence

66%

Full breach record for South Country Health Alliance →2 incidents on file

South Country Health Alliance notified individuals of a data breach where unauthorized access to an employee email account occurred on June 25, 2020, discovered on September 14, 2020. Personal information may have been accessed. The organization engaged cybersecurity experts, secured the account, and offered 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 81 days

discovery → filing · 15 weeks / 107 days

Jun 25, 2020

Begins

Sep 14, 2020

Discovered

Dec 30, 2020

Filed

vs. sector median

+6 wks slower

This filing is one of 6 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Indiana State AGbd_9127282b4322a5022020-12-30Verified
Maine State AGbd_94d19799f61e98092020-12-30Verified
New Hampshire State AGbd_dba0b9c9a16599422020-12-30Verified
HHS OCRbd_93844ab412a4a97f2020-12-31 · +1dVerified

Show 1 more filing ↓up to 6d gap

Massachusetts State AGbd_7d14f1778476df152021-01-05 · +6dVerified

Name: South Country Health Alliance
norm: south country health alliance

Name: South Country Health Alliance
norm: south country health alliance
Industry: Healthcarellm

Discovered: Sep 14, 2020
Breach occurred: Jun 25, 2020
Undetected for: 81 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 30, 2020
Affected individuals: 20state-resident count only
Data types: PIIIdentity (basic)
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Initial access: phishing_link

During the incident: Secured the account
Began an investigation
Engaged cybersecurity experts to assist us with the investigation
Took steps to identify mailing addresses for potentially impacted individuals
Offering 12 months of credit monitoring and identity protection services at no cost
Changes made: Enhanced the security of our email environment
Enhanced password protections
Adopted multifactor authentication
Enhanced employee security training
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 15 weeks(107 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Indiana State AGDec 30 · first

Maine State AGDec 30 · first

New Hampshire State AGDec 30 · first

Montana State AGDec 30 · first · this page

HHS OCR+1d

Massachusetts State AG+6d

Pattern: first filing Dec 30 (IN), last Jan 5 (MA) — a 6-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/schaSamp.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 30, 2020
Raw hash: 5ad149faa9c99115400c16273f734b4c187072ea9de0f1c8df33719b3c763919

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entitySouth Country Health Alliance

Victim entitySouth Country Health Alliance

Incidentdiscovered Sep 14, 2020

Stated responseSecured the account

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov