MalwareHealthcareHealthcareRansomwareData MishandlingSupply Chain (3P Vendor)Data ExfiltratedRansom DemandedRansom PaidCustomer Data InvolvedIdentity (basic)Health (basic)BehaviorLowActive

INOVA HEALTH SYSTEM FOUNDATION

bd_4cea0b8a1367835a · schema v1 · pii pii-v1

Severity

Low

Discovered

Jul 16, 2020

Filed

Sep 15, 2020

To disclose

9 weeks

Affected

Not disclosed

Linked

4 filings

Confidence

65%

Full breach record for INOVA HEALTH SYSTEM FOUNDATION →6 incidents on file

Inova Health System notified patients of a data security incident involving third-party provider Blackbaud. A ransomware attack on Blackbaud between Feb 7 and May 20, 2020, resulted in data exfiltration. Inova was notified on July 16, 2020. Affected data includes names, addresses, DOBs, phone numbers, provider names, dates of service, hospital departments, and philanthropic giving history. SSNs and financial account info were not exposed. Blackbaud paid the ransom to ensure data destruction.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 160 days

discovery → filing · 9 weeks / 61 days

Feb 7, 2020

Begins

Jul 16, 2020

Discovered

Sep 15, 2020

Filed

vs. sector median

4 wks faster

This filing is one of 4 about the same incident.View merged incident

Part of BLACKBAUD, INC. supply-chain incident (2020) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

HHS OCRbd_cf1753ab447b52542020-09-09 · +6dVerified
Washington State AGbd_e64407193b9828fb2020-09-09 · +6dVerified
Oregon State AGbd_c39af1065b9670912020-09-22 · +7dVerified

Name: INOVA HEALTH SYSTEM FOUNDATION
norm: inova health system

Name: INOVA HEALTH SYSTEM FOUNDATION
norm: inova health system
Industry: Healthcarellm

Discovered: Jul 16, 2020
Breach occurred: Feb 7, 2020 – May 20, 2020
Undetected for: 160 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Identity (basic)Health (basic)Behavior
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 ChannelT1195 Supply Chain Compromise
Threat actor: ExternalFinancial
Third party: via Blackbaud
Initial access: supply_chain

During the incident: Commenced an immediate and thorough investigation
Engaged cybersecurity professionals experienced in handling these types of incidents
Demanded detailed information from Blackbaud about the nature and scope of the incident
Set up a dedicated and confidential toll-free response line
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(61 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

HHS OCRSep 9 · first

Washington State AGSep 9 · first

California State AG+6d · this page

Oregon State AG+13d

Pattern: first filing Sep 9 (VA), last Sep 22 (OR) — a 13-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-194048
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 15, 2020
Raw hash: caf57006c830c484ff75ce7da371f97775248d98f2e0eceb9580bb7d9434d58b

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityINOVA HEALTH SYSTEM FOUNDATION

Victim entityINOVA HEALTH SYSTEM FOUNDATION

Incidentdiscovered Jul 16, 2020

Stated responseCommenced an immediate and thorough investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov