HackingHealthcareHealthcareCustomer Data InvolvedEmployee Data InvolvedPHIIdentity (basic)Government IDHealth (basic)MediumContained

Elmcroft Senior Living, Inc.

bd_56453ba7eacccb44 · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 12, 2018

Filed

Jun 1, 2018

To disclose

20 days

Affected

Not disclosed

Linked

7 filings

Confidence

65%

Full breach record for Elmcroft Senior Living, Inc. →

Elmcroft Senior Living, Inc. reported that an unauthorized third party accessed its servers between May 10 and May 12, 2018. The company became aware of the incident on May 12, 2018, and immediately terminated the unauthorized access. The breach potentially exposed demographic data and personal health information, including names, dates of birth, addresses, and in some instances, social security numbers of residents and patients. The company notified law enforcement and offered one year of identity monitoring services through Kroll.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 2 days

discovery → filing · 20 days

May 10, 2018

Begins

May 12, 2018

Discovered

Jun 1, 2018

Filed

vs. sector median

10 wks faster

This filing is one of 7 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

Delaware State AGbd_121717ac4f1810f72018-06-08 · +7dVerified
Massachusetts State AGbd_329bab0b9ea627d92018-06-08 · +7dVerified
New Hampshire State AGbd_8e328f0860b758102018-06-08 · +7dVerified
Montana State AGbd_8f5f94f192c567b32018-06-08 · +7dVerified

Show 2 more filings ↓up to 26d gap

HHS OCRbd_67168058419f205b2018-05-21 · +11dVerified
South Carolina State AGbd_168183e6da0cf1692018-06-27 · +26dVerified

Name: Elmcroft Senior Living, Inc.
norm: elmcroft senior living

Name: Elmcroft Senior Living, Inc.
norm: elmcroft senior living
Industry: Healthcarellm

Discovered: May 12, 2018
Breach occurred: May 10, 2018 – May 12, 2018
Undetected for: 2 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: PHIIdentity (basic)Government IDHealth (basic)
Data elements: Date of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified local and federal law enforcement agencies

During the incident: Immediately terminated the third party’s unauthorized access
Promptly initiated an investigation to determine how the access occurred, and what information was or may have been accessed
Notified local and federal law enforcement agencies and are cooperating with those entities as they investigate this incident
Secured the services of Kroll to provide identity monitoring at no cost to you for one year
Changes made: Revisit our security measures periodically in an attempt to reduce the likelihood that third parties will access electronically-stored information
Work to determine if there are additional reasonable steps that we should take to lessen the chance of future incidents
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 20 days(20 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 7 states

View merged incident ↗

HHS OCRMay 21 · first

California State AG+11d · this page

Delaware State AG+18d

Massachusetts State AG+18d

New Hampshire State AG+18d

Montana State AG+18d

South Carolina State AG+37d

Pattern: first filing May 21 (TX), last Jun 27 (SC) — a 37-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-136753
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 1, 2018
Raw hash: 12d4db24df478ca21fb814224c52302502184cfa315fb1f85ea1e1d9ce3f3251

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityElmcroft Senior Living, Inc.

Victim entityElmcroft Senior Living, Inc.

Incidentdiscovered May 12, 2018

Stated responseImmediately terminated the third party’s unauthorized access

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov