Social EngineeringHealthcareHealthcarePhishingStolen CredentialsData ExfiltratedCustomer Data InvolvedDelayed DiscoveryAuthenticationCredentialsFinancial accountHealth (basic)Identity (basic)Government IDPHIHighContained

Columbia River Mental Health Services

bd_3d0b1b39da1199ea · schema v1 · pii pii-v1

Severity

High

Discovered

Mar 21, 2022

Filed

Oct 4, 2022

To disclose

28 weeks

Affected

17,020state residents only

Linked

5 filings

Confidence

71%

Full breach record for Columbia River Mental Health Services →2 incidents on file

Columbia River Mental Health Services notified Washington AG of a phishing incident affecting 17,020 residents. Unauthorized access to email accounts occurred from May 14, 2021 to April 8, 2022. Data exposed included names, SSNs, financial accounts, medical info, and credentials. Discovery was March 21, 2022; notification sent October 4, 2022.

J jump to incidentP pin to compareR raw source

Washington clock✗ WA AG >90d28 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 311 days

discovery → filing · 28 weeks / 197 days

May 14, 2021

Begins

Mar 21, 2022

Discovered

Oct 4, 2022

Filed

vs. sector median

+16 wks slower

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Oregon State AGbd_8a46d38470e9032c2022-10-04Verified
Indiana State AGbd_971929d4c26eb7492022-10-04Verified
Montana State AGbd_be52ff5974c0c5c02022-10-04Verified
New Hampshire State AGbd_274084aef9e4928e2022-10-07 · +3dVerified

Name: Columbia River Mental Health Services
norm: columbia river mental health

Name: Columbia River Mental Health Services
norm: columbia river mental health
Industry: Healthcarellm

Discovered: Mar 21, 2022
Breach occurred: May 14, 2021 – Apr 8, 2022
Undetected for: 311 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 4, 2022
Affected individuals: 17,020state-resident count only
Data types: Identity (basic)Government IDFinancial accountHealth (basic)Credentials
Data elements: NameSocial Security numberDriver's licence numberFinancial account numberDate of birthPassport numberHealth insurance IDMedical informationUsername + password
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 300-399dexposure 300-399d
WA-stated discovery: Found while ongoing
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Initial access: phishing_link

During the incident: Launched an investigation with the assistance of third-party forensic investigators
Providing access to credit monitoring services for twelve (12) months through Epiq
Providing impacted individuals with guidance on how to better protect against identity theft and fraud
Changes made: Working to implement additional safeguards and training to its employees
Continue to review policies and procedures relating to data privacy and security
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 28 weeks(197 days from discovery to filing)
Compliance flags: WA AG >90d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Oregon State AGOct 4 · first

Indiana State AGOct 4 · first

Montana State AGOct 4 · first

Washington State AGOct 4 · first · this page

New Hampshire State AG+3d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA15522.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 4, 2022
Raw hash: a545735b77b1e5aca3da1606db11a46c85455fddfe5879f34fc2b70ce2375753

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityColumbia River Mental Health Services

Victim entityColumbia River Mental Health Services

Incidentdiscovered Mar 21, 2022

Stated responseLaunched an investigation with the assistance of third-party forensic investigators

ComplianceWA AG >90d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com