Social EngineeringHealthcareHealthcarePhishingStolen CredentialsData ExfiltratedCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDHealth (basic)PIIMediumContained

ELIZABETHTOWN COMMUNITY HOSPITAL

bd_464b7e765f42b199 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Oct 9, 2018

Filed

Dec 17, 2018

To disclose

10 weeks

Affected

6state residents only

Linked

2 filings

Confidence

64%

Full breach record for ELIZABETHTOWN COMMUNITY HOSPITAL →

Elizabethtown Community Hospital (part of UVM Health Network) notified affected individuals of a security incident on October 9, 2018, where an unauthorized party remotely accessed an employee's email account via phishing. The investigation, completed December 11, 2018, confirmed exposure of names, SSNs, DOBs, driver's license numbers, and limited medical/billing information. The organization offered one year of Experian IdentityWorks credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 10 weeks / 69 days

Oct 9, 2018

Begins

Oct 9, 2018

Discovered

Dec 17, 2018

Filed

vs. sector median

1 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

New Hampshire State AGbd_fbc71a0799fdd5dc2018-12-17Candidate

Name: University of Vermont Health Network
norm: university of vermont health

Name: ELIZABETHTOWN COMMUNITY HOSPITAL
norm: elizabethtown community hospital
Industry: Healthcarellm

Discovered: Oct 9, 2018
Breach occurred: Oct 9, 2018
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 17, 2018
Affected individuals: 6state-resident count only
Data types: Identity (basic)Government IDHealth (basic)PII
Data elements: Social Security numberDate of birthMedical information
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: External
Initial access: phishing_link

During the incident: Changing passwords
Implementing enhanced security features
Engaging a leading forensic security firm to assist with the investigation
Changes made: Implementing enhanced security features
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 10 weeks(69 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

New Hampshire State AGDec 17 · first

Montana State AGDec 17 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Breach-NotificationDetails-89.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 17, 2018
Raw hash: 2447f1e7633ff9b611d6055a3f1f0f9c4efe08a4ad7a58ba73464469dc0e2c4f

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityUniversity of Vermont Health Network

Victim entityELIZABETHTOWN COMMUNITY HOSPITAL

Incidentdiscovered Oct 9, 2018

Stated responseChanging passwords

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov