Social EngineeringHealthcareHealthcarePhishingStolen CredentialsCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Government IDFinancial accountPHIHealth (basic)MediumContained

Health Quest Systems, Inc.

bd_46fbe80968b6b247 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 1, 2018

Filed

Jan 10, 2020

To disclose

19 months

Affected

Not disclosed

Linked

3 filings

Confidence

64%

Full breach record for Health Quest Systems, Inc. →3 incidents on file

Health Quest Systems, Inc. experienced a phishing incident in July 2018 where employees were tricked into disclosing email credentials. An unauthorized party accessed these accounts. A comprehensive review completed in November 2019 determined that patient information, including names, SSNs, driver's license numbers, passport numbers, financial account info, health insurance info, and clinical data, may have been exposed. The company secured accounts, engaged forensic investigators, and is offering credit monitoring. Remediation includes MFA and security training.

J jump to incidentP pin to compareR raw source

Incident timeline

Jul 11, 2018

Begins

Jan 10, 2020

Filed

vs. sector median

+67 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_2c07aeaadeccac382020-01-10Verified
Montana State AGbd_4435fcd8dc716a372020-01-10Verified

Name: Health Quest Systems, Inc.
norm: health quest

Name: Health Quest Systems, Inc.
norm: health quest
Industry: Healthcarellm

Discovered: Jul 1, 2018
Breach occurred: Jul 11, 2018
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDFinancial accountPHIHealth (basic)
Data elements: Social Security numberMedical information
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: External
Initial access: phishing_link

During the incident: Secured the employee email accounts in question
Engaged a leading cyber security firm to assist with the investigation
Performed a comprehensive review of the voluminous contents of the email accounts
Offering a complimentary one-year membership to Experian’s IdentityWorks credit monitoring service
Changes made: Implementation of multi-factor authentication for email
Additional procedures to further expand and strengthen security processes
Providing additional training to employees regarding phishing emails and other cybersecurity issues
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 19 months(558 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Massachusetts State AGJan 10 · first

Montana State AGJan 10 · first

California State AGJan 10 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-185843
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 10, 2020
Raw hash: a57c46bb213ef8063804d74754b26f26d55618cdbc69945e8e668ca7daeaf2dc

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityHealth Quest Systems, Inc.

Victim entityHealth Quest Systems, Inc.

Incidentdiscovered Jul 1, 2018

Stated responseSecured the employee email accounts in question

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov