AccidentalHealthcareProfessional ServicesHealthcareMisconfigurationCustomer Data InvolvedCredentialsIdentity (basic)LowResolved

Public Health Institute

bd_53e56dd806e7e2bc · schema v1 · pii pii-v1

Severity

Low

Discovered

Aug 4, 2016

Filed

Oct 5, 2016

To disclose

9 weeks

Affected

Not disclosed

Confidence

65%

Full breach record for Public Health Institute →

The Public Health Institute (PHI) disclosed that a database containing email addresses and passwords for the California Environmental Health Tracking Program (CEHTP) was accessible on the internet without encryption for approximately 30 days, starting July 4, 2016. PHI discovered the misconfiguration on August 4, 2016. The incident affected user accounts for the CEHTP Water Boundary Tool, the retired CEHTP Geocoding Tool, and a retired California Department of Public Health system. PHI removed the database, reset passwords, and implemented bcrypt encryption. No other personal information was exposed.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 31 days

discovery → filing · 9 weeks / 62 days

Jul 4, 2016

Begins

Aug 4, 2016

Discovered

Oct 5, 2016

Filed

vs. sector median

2 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: Public Health Institute
norm: public health institute
Domain: phi.org

Name: Public Health Institute
norm: public health institute
Domain: phi.org
Industry: HealthcarellmProfessional Servicesllm

Discovered: Aug 4, 2016
Breach occurred: Jul 4, 2016 – Aug 3, 2016
Undetected for: 31 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 5, 2016
Affected individuals: Not disclosed
Data types: CredentialsIdentity (basic)
Attack vector: Misconfiguration
Initial access: exploit_public_facing

During the incident: Removed the database from the internet
Removed all passwords from the active system
Required returning users to create a new password
Closed out user accounts associated solely with the retired CEHTP Geocoding Tool and the retired EHIB content management system
Changes made: Updated system to use bcrypt, an industry standard encryption solution, to protect user account information
Updated security procedures to ensure that user account information remains protected
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(62 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-64216
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 5, 2016
Raw hash: 89b73f95f672961988de178f82155a1deb6f9ac9797bd1a10e2d80b0221cc493

Reporting entityPublic Health Institute

Victim entityPublic Health Institute

Incidentdiscovered Aug 4, 2016

Stated responseRemoved the database from the internet

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov