PhysicalHealthcareHealthcareTheftOpportunisticCustomer Data InvolvedIdentity (basic)Government IDHealth (basic)PHIMediumResolved

The Health & Wellness Clinic

bd_4063d8828c2757c2 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 31, 2020

Filed

Oct 16, 2020

To disclose

7 weeks

Affected

889state residents only

Confidence

70%

Full breach record for The Health & Wellness Clinic →

The Health & Wellness Clinic reported a physical theft of patient records in Washington. Intruders broke into a storage room on August 29-30, 2020, stealing a box containing names, SSNs, DOBs, and health history. The clinic discovered the breach on August 31, 2020, and notified the police. 889 Washington residents were affected. Records were recovered by police.

J jump to incidentP pin to compareR raw source

Washington clock⏱ WA AG >30d7 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 2 days

discovery → filing · 7 weeks / 46 days

Aug 29, 2020

Begins

Aug 31, 2020

Discovered

Oct 16, 2020

Filed

vs. sector median

4 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed889 affectedView incident

Name: The Health & Wellness Clinic
norm: the health wellness clinic

Name: The Health & Wellness Clinic
norm: the health wellness clinic
Industry: Healthcarellm

Discovered: Aug 31, 2020
Breach occurred: Aug 29, 2020 – Aug 30, 2020
Undetected for: 2 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 889state-resident count only
Data types: Identity (basic)Government IDHealth (basic)PHI
Data elements: NameSocial Security numberDriver's licence numberDate of birthMedical information
WA-stated cause: Theft or Mistake
WA-stated duration: lifecycle 1-99dexposure 1-99d
WA-stated discovery: Found after the fact
Attack vector: Unauthorized Access
MITRE ATT&CK: T1052 Exfiltration Over Physical Medium
Threat actor: External
Regulator citations: Notified Washington State Attorney General

During the incident: Contacted the police
Police dusted for prints
Retrieved missing box of patient records from a ditch
Changes made: Moved all patient records from storage room to an interior room in the main building
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 weeks(46 days from discovery to filing)
Compliance flags: WA AG >30d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10341.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 16, 2020
Raw hash: 199a998c5a87add1471f5d31b03a9083c8ecd261f95b8e9b1a0f6f73f5532441

Reporting entityThe Health & Wellness Clinic

Victim entityThe Health & Wellness Clinic

Incidentdiscovered Aug 31, 2020

Stated responseContacted the police

ComplianceWA AG >30d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com