MalwareHealthcareHealthcareRansomwareData MishandlingData ExfiltratedData EncryptedSupply Chain (3P Vendor)Business Associate (HIPAA)Customer Data InvolvedPHIHealth (basic)Identity (basic)LowContained

Enloe Medical Center

bd_38b9ba197277c322 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jul 16, 2020

Filed

Sep 10, 2020

To disclose

8 weeks

Affected

Not disclosed

Linked

3 filings

Confidence

65%

Full breach record for Enloe Medical Center →2 incidents on file

Enloe Medical Center notified patients of a data breach resulting from a ransomware attack on its third-party vendor, Blackbaud, Inc. The incident occurred between May 14 and May 20, 2020, and was discovered by Enloe on July 16, 2020. Affected data included names, addresses, medical treatment discharge dates, departments, and potentially dates of birth, phone numbers, and email addresses. Social Security numbers and financial data were not involved. Enloe is reviewing vendor policies and notifying regulators.

J jump to incidentP pin to compareR raw source

California clockDiscovered Jul 16, 2020 → Notified Sep 10, 202056d ✓ CA 60-day OK8 weeks discovery → filing

Incident timeline

undetected · 63 days

discovery → filing · 8 weeks / 56 days

May 14, 2020

Begins

Jul 16, 2020

Discovered

Sep 10, 2020

Filed

vs. sector median

5 wks faster

This filing is one of 3 about the same incident.View merged incident

Part of BLACKBAUD, INC. supply-chain incident (2020) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

HHS OCRbd_8ac494597dcf950b2020-09-10Verified
Montana State AGbd_f41790a7efac86bf2020-09-10Verified

Name: Enloe Medical Center
norm: enloe medical center
Domain: mychart.enloe.org

Name: Enloe Medical Center
norm: enloe medical center
Domain: mychart.enloe.org
Industry: Healthcarellm

Discovered: Jul 16, 2020
Breach occurred: May 14, 2020 – May 20, 2020
Undetected for: 63 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 10, 2020
Affected individuals: Not disclosed
Data types: PHIHealth (basic)Identity (basic)
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 ChannelT1195 Supply Chain Compromise
Threat actor: ExternalFinancial
Regulator citations: Notifying the United States Department of Health and Human Services and state regulators
Third party: via Blackbaud, Inc.
Initial access: supply_chain

During the incident: Commenced an investigation to better understand the nature and scope of the incident
Working with Blackbaud to evaluate additional measures and safeguards
Reviewing existing policies and procedures regarding third-party vendors
Notifying the United States Department of Health and Human Services and state regulators
Changes made: Reviewing existing policies and procedures regarding third-party vendors
Evaluating additional measures and safeguards to protect against this type of incident in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(56 days from discovery to filing)
Compliance flags: CA 60-day OK · 56d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Jul 16, 2020
→ Notified: Sep 10, 2020
56d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Jul 16, 2020 → Notified: Sep 10, 2020	56d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 2 states

View merged incident ↗

HHS OCRSep 10 · first

Montana State AGSep 10 · first

California State AGSep 10 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-193944
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 10, 2020
Raw hash: 98ee67d3a23e2fa04e4854a8694e91587f0d72e4cbdf4d0dc4bee6a375f457fd

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityEnloe Medical Center

Victim entityEnloe Medical Center

Incidentdiscovered Jul 16, 2020

Stated responseCommenced an investigation to better understand the nature and scope of the incident

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov