Social EngineeringHealthcareHealthcarePhishingStolen CredentialsCustomer Data InvolvedEmployee Data InvolvedPHIHealth (basic)Identity (basic)LowContained

Covenant Care California, LLC

bd_444697bec78f4b28 · schema v1 · pii pii-v1

Severity

Low

Discovered

Feb 24, 2022

Filed

May 9, 2022

To disclose

11 weeks

Affected

Not disclosed

Linked

4 filings

Confidence

66%

Full breach record for Covenant Care California, LLC →8 incidents on file

Covenant Care California, LLC notified the California Attorney General of a data breach involving Wagner Heights Nursing and Rehabilitation Center. On February 24, 2022, an employee's email account was compromised via a phishing email, allowing an unauthorized actor access for several hours. The incident potentially exposed patient records, including protected health information (PHI) and personally identifiable information (PII). The company secured the account, engaged forensic investigators, and is offering one year of identity monitoring to affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 11 weeks / 74 days

Feb 24, 2022

Begins

Feb 24, 2022

Discovered

May 9, 2022

Filed

vs. sector median

2 wks faster

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

HHS OCRbd_7661bb914420c3db2022-05-06 · +3dVerified
Montana State AGbd_7b0ab00c082509be2022-05-06 · +3dVerified
California State AGbd_6dec4a99bf50f3f12022-06-22 · +44dVerified

Name: Covenant Care California, LLC
norm: covenant care california

Name: Covenant Care California, LLC
norm: covenant care california
Industry: Healthcarellm

Discovered: Feb 24, 2022
Breach occurred: Feb 24, 2022 – Feb 24, 2022
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: PHIHealth (basic)Identity (basic)
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: External
Regulator citations: Reporting this incident to law enforcement and appropriate state and federal regulators
Initial access: phishing_link

During the incident: Took immediate steps to secure the affected email account
Commenced an investigation to determine the nature and scope of the incident
Engaged third-party forensic investigators
Undertook a diligent review and analysis of the email account
Reporting this incident to law enforcement and appropriate state and federal regulators
Changes made: Reviewing technical, administrative, and physical safeguards to identify and implement potential enhancements
Installing additional technical safeguards to email systems
Reviewing general privacy and security policies and procedures for potential enhancements
Reviewing policies and procedures specific to employee training on email security
Conducting additional employee retraining regarding email safety and security awareness
Providing one year of Identity Monitoring services through Kroll
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 11 weeks(74 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 2 states

View merged incident ↗

HHS OCRMay 6 · first

Montana State AGMay 6 · first

California State AG+3d · this page

California State AG+47d

Pattern: first filing May 6 (CA), last Jun 22 (CA) — a 47-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-553239
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 9, 2022
Raw hash: 94897296c80a6823d5f6391460ae2cd3e90417cb2a0dd3f6d2bf535ff98cb302

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityCovenant Care California, LLC

Victim entityCovenant Care California, LLC

Incidentdiscovered Feb 24, 2022

Stated responseTook immediate steps to secure the affected email account

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov