Social EngineeringHealthcareHealthcarePhishingStolen CredentialsMulti-Stage ChainCustomer Data InvolvedDelayed DiscoveryData ExfiltratedIDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTPHIHEALTH_BASICMediumContained
Health Quest Systems, Inc.
bd_46fbe80968b6b247 · schema v1 · pii pii-v1
Full breach record for Health Quest Systems, Inc. →Health Quest Systems, Inc. experienced a phishing attack beginning in July 2018, in which employees were tricked into disclosing email account credentials to an unauthorized party. The incident was fully investigated by November 2019. Potentially exposed data includes names, SSNs, driver's license numbers, passport numbers, financial account information, health insurance, and clinical information. HQ secured affected accounts, engaged a cybersecurity firm, and offered Experian credit monitoring to affected individuals.
Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-185843
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jan 10, 2020
- Raw hash
- a57c46bb213ef8063804d74754b26f26d55618cdbc69945e8e668ca7daeaf2dc
Reporting entity
- Name
- Health Quest Systems, Inc.norm: health quest
Victim entity
- Name
- Health Quest Systems, Inc.norm: health quest
- Industry
- Healthcarellm
Incident
- Discovered
- Jul 1, 2018
- Materiality determined
- —
- Notification sent
- —
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTPHIHEALTH_BASIC
- Attack vector
- Phishing
- MITRE ATT&CK
- T1566 PhishingT1078 Valid AccountsT1114 Email Collection
- Threat actor
- External
- Initial access
- phishing_attachment
Compliance
- Time to disclose
- 19 months(558 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.