HackingHealthcareHealthcareVulnerability ExploitCapture Stored DataSupply Chain (3P Vendor)Business Associate (HIPAA)Data ExfiltratedCustomer Data InvolvedZero-DayPHIHealth (basic)Identity (basic)Financial accountLowContained

TRINITY HEALTH CORPORATION

bd_4c49d240e8481b68 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jan 29, 2021

Filed

Apr 5, 2021

To disclose

9 weeks

Affected

Not disclosed

Linked

5 filings

Confidence

66%

Full breach record for TRINITY HEALTH CORPORATION →19 incidents on file

Trinity Health notified patients of a security incident involving its third-party vendor, Accellion. An unknown user exploited a previously unknown vulnerability in the Accellion File Transfer Appliance to download files containing protected health information (PHI) on January 20, 2021. Trinity Health was notified on January 29, 2021, and immediately took the appliance offline. The breach affected patients across multiple states. Trinity Health is offering credit monitoring services.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 9 days

discovery → filing · 9 weeks / 66 days

Jan 20, 2021

Begins

Jan 29, 2021

Discovered

Apr 5, 2021

Filed

vs. sector median

on median

This filing is one of 5 filings about the same incident.View merged incident

Part of Accellion supply-chain incident (2021) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Maine State AGbd_7e00641b86d5c4652021-04-05Verified
HHS OCRbd_cc9ffa94f61eca592021-04-05Verified
Massachusetts State AGbd_f38f4262ebb55fab2021-04-05Verified
New Hampshire State AGbd_e2f2fc6b7a24541d2021-04-09 · +4dVerified

Name: TRINITY HEALTH CORPORATION
norm: trinity health
Domain: trinity-health.org

Name: TRINITY HEALTH CORPORATION
norm: trinity health
Domain: trinity-health.org
Industry: Healthcarellm

Discovered: Jan 29, 2021
Breach occurred: Jan 20, 2021
Undetected for: 9 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: PHIHealth (basic)Identity (basic)Financial account
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1195 Supply Chain CompromiseT1041 Exfiltration Over C2 Channel
Threat actor: External
Initial access: exploit_public_facing

During the incident: Took the appliance offline
Launched an investigation into the issue and its impact
Confirmed the security of our network
Offering the patient complimentary access to credit monitoring services
Established a call center to answer questions
Changes made: Further evaluating our data security policies and procedures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(66 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Maine State AGApr 5 · first

HHS OCRApr 5 · first

Massachusetts State AGApr 5 · first

California State AGApr 5 · first · this page

New Hampshire State AG+4d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-539704
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 5, 2021
Raw hash: 8e37778b2145140d17ff603a51b36f820605a23663bf50bbf6ad931000d30886

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityTRINITY HEALTH CORPORATION

Victim entityTRINITY HEALTH CORPORATION

Incidentdiscovered Jan 29, 2021

Stated responseTook the appliance offline

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov