Social EngineeringHealthcareHealthcarePhishingTargetedPHIHealth (basic)Government IDIdentity (basic)MediumContained

Burrell Behavioral Health

bd_374d1efa5c4315ac · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 7, 2016

Filed

Sep 6, 2016

To disclose

9 weeks

Affected

1state residents only

Linked

2 filings

Confidence

66%

Full breach record for Burrell Behavioral Health →2 incidents on file

Burrell Behavioral Health notified clients of a July 2016 incident where an employee's email account was compromised via phishing. Access potentially occurred July 6-7, 2016. PHI, SSNs, and PII were at risk. The company engaged forensic investigators, notified law enforcement and HHS, and offered one year of credit monitoring via Kroll.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 1 days

discovery → filing · 9 weeks / 61 days

Jul 6, 2016

Begins

Jul 7, 2016

Discovered

Sep 6, 2016

Filed

vs. sector median

3 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

HHS OCRbd_629722d8b66d05872016-09-02 · +4dVerified

Name: Burrell Behavioral Health
norm: burrell behavioral health
Domain: burrellcenter.com

Name: Burrell Behavioral Health
norm: burrell behavioral health
Domain: burrellcenter.com
Industry: Healthcarellm

Discovered: Jul 7, 2016
Breach occurred: Jul 6, 2016 – Jul 7, 2016
Undetected for: 1 dayoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 1state-resident count only
Data types: PHIHealth (basic)Government IDIdentity (basic)
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid Accounts
Threat actor: External
Regulator citations: reported this incident to law enforcementproviding notice of this incident to certain state regulators, consumer reporting agencies and the Department of Health and Human Services
Initial access: phishing_link

During the incident: Hired an outside computer forensic investigator to supplement our internal investigation
Reported this incident to law enforcement
Secured the services of Kroll to provide identity monitoring at no cost to you for one (1) year
Providing notice of this incident to all potentially impacted individuals
Changes made: Secured the email account
Launched an investigation to determine whether any sensitive information was accessed or acquired
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(61 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

HHS OCRSep 2 · first

Montana State AG+4d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/Burrell-Behavioral-Health.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 6, 2016
Raw hash: 7d1de7741bd1d670b2e408652f372232946ea280675b46b41ab16467ae24cb44

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityBurrell Behavioral Health

Victim entityBurrell Behavioral Health

Incidentdiscovered Jul 7, 2016

Stated responseHired an outside computer forensic investigator to supplement our internal investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov