MalwareHealthcareHealthcareRansomwareData ExfiltratedData EncryptedCustomer Data InvolvedPIIIdentity (basic)Government IDFinancial accountPHIHealth (basic)CriticalContained

Chelan Douglas Health District

bd_431f93634426062b · schema v1 · pii pii-v1

Severity

Critical

Discovered

Jul 5, 2021

Filed

Mar 15, 2022

To disclose

36 weeks

Affected

108,906state residents only

Linked

3 filings

Confidence

71%

Full breach record for Chelan Douglas Health District →

Chelan Douglas Health District notified Washington AG of a cyberattack occurring July 2-4, 2021. Unauthorized access resulted in exfiltration of PII and PHI including SSNs, DOBs, driver's licenses, financial accounts, and medical info. Incident discovered July 5, 2021. Notifications sent March 15, 2022 to ~108,906 residents, offering credit monitoring.

J jump to incidentP pin to compareR raw source

Washington clock✗ WA AG >90d36 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 3 days

discovery → filing · 36 weeks / 253 days

Jul 2, 2021

Begins

Jul 5, 2021

Discovered

Mar 15, 2022

Filed

vs. sector median

+24 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Montana State AGbd_4a8ef51c11d49b282022-03-15Verified
HHS OCRbd_84e1de47990cfeef2022-03-15Verified

Name: Chelan Douglas Health District
norm: chelan douglas health district

Name: Chelan Douglas Health District
norm: chelan douglas health district
Industry: Healthcarellm

Discovered: Jul 5, 2021
Breach occurred: Jul 2, 2021 – Jul 4, 2021
Undetected for: 3 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 15, 2022
Affected individuals: 108,906state-resident count only
Data types: PIIIdentity (basic)Government IDFinancial accountPHIHealth (basic)
Data elements: NameSocial Security numberDriver's licence numberFinancial account numberDate of birthHealth insurance IDMedical information
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 1-99dexposure 1-99d
WA-stated discovery: Found after the fact
Attack vector: Unknown
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified Washington Attorney General Consumer Protection Division

During the incident: Launched an investigation in consultation with outside cybersecurity professionals
Providing the affected residents with written notification of this incident
Offering the affected residents whose Social Security numbers were impacted complimentary one-year memberships with a credit monitoring service
Providing the affected residents with the contact information for the consumer reporting agencies and the Federal Trade Commission
Changes made: Continually evaluates and modifies its practices and internal controls to enhance the security and privacy of personal information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 36 weeks(253 days from discovery to filing)
Compliance flags: WA AG >90d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 2 states

View merged incident ↗

Montana State AGMar 15 · first

HHS OCRMar 15 · first

Washington State AGMar 15 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM13163.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 15, 2022
Raw hash: a396ff4480fbd90b0d8c4b6e0c590b69b8dc0730b00faeafa8be290c599878f4

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityChelan Douglas Health District

Victim entityChelan Douglas Health District

Incidentdiscovered Jul 5, 2021

Stated responseLaunched an investigation in consultation with outside cybersecurity professionals

ComplianceWA AG >90d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com