HackingHealthcareHealthcareStolen CredentialsCustomer Data InvolvedDelayed DiscoveryPHIGovernment IDIdentity (basic)Health (basic)MediumContained

Santa Rosa Community Health Centers

bd_51ede7b41ef37326 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Dec 30, 2020

Filed

Feb 26, 2021

To disclose

8 weeks

Affected

Not disclosed

Linked

2 filings

Confidence

65%

Full breach record for Santa Rosa Community Health Centers →2 incidents on file

Santa Rosa Community Health Centers experienced unauthorized access to a corporate email account, potentially exposing PHI including names, SSNs, dates of birth, addresses, health insurance/billing info, and diagnosis/treatment plans. The breach occurred on Jan 29, 2020, but was discovered on Dec 30, 2020, after suspicious email activity was identified. The organization engaged forensic experts, reset passwords, implemented MFA, and offered identity protection services.

J jump to incidentP pin to compareR raw source

California clockDiscovered Dec 30, 2020 → Notified Feb 26, 202158d ✓ CA 60-day OK8 weeks discovery → filing

Incident timeline

undetected · 336 days

discovery → filing · 8 weeks / 58 days

Jan 29, 2020

Begins

Dec 30, 2020

Discovered

Feb 26, 2021

Filed

vs. sector median

3 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

HHS OCRbd_5826c76758c137c42021-02-26Candidate

Name: Santa Rosa Community Health Centers
norm: santa rosa community health centers

Name: Santa Rosa Community Health Centers
norm: santa rosa community health centers
Industry: Healthcarellm

Discovered: Dec 30, 2020
Breach occurred: Jan 29, 2020
Undetected for: 336 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 26, 2021
Affected individuals: Not disclosed
Data types: PHIGovernment IDIdentity (basic)Health (basic)
Data elements: Social Security numberDate of birthMedical information
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: External
Initial access: valid_credentials

During the incident: Engaged independent computer forensic experts to help us investigate this activity
Engaged a vendor to conduct a comprehensive review of the affected email account
Performed a global password reset for all email accounts
Increased our anti-malware and spam filters
Implemented multi-factor authentication on all email accounts
Offering identity theft protection services through IDX
Changes made: Retraining our employees on cybersecurity and on recognizing and responding to suspicious emails
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(58 days from discovery to filing)
Compliance flags: CA 60-day OK · 58d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Dec 30, 2020
→ Notified: Feb 26, 2021
58d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Dec 30, 2020 → Notified: Feb 26, 2021	58d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings

View merged incident ↗

HHS OCRFeb 26 · first

California State AGFeb 26 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-538397
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 26, 2021
Raw hash: ad8199e2a6e751a731e4ee45e627b73c20874057ee106fe339681d3f56e74aa9

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entitySanta Rosa Community Health Centers

Victim entitySanta Rosa Community Health Centers

Incidentdiscovered Dec 30, 2020

Stated responseEngaged independent computer forensic experts to help us investigate this activity

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov