Social EngineeringHealthcareHealthcarePhishingStolen CredentialsCustomer Data InvolvedEmployee Data InvolvedMulti-Stage ChainPHIGovernment IDIdentity (basic)Financial accountBiometricHighContained

Ransom Memorial Hospital

bd_575fe3ff602c8e05 · schema v1 · pii pii-v1

Severity

High

Discovered

Sep 24, 2018

Filed

Oct 19, 2018

To disclose

25 days

Affected · nationwide

16,3661 in this filing

Confidence

66%

Full breach record for Ransom Memorial Hospital →2 incidents on file

Ransom Memorial Hospital (Kansas) reported a phishing incident where 9 employee email accounts were compromised between May 31 and June 11, 2018. Discovered Sept 24, 2018, the breach exposed PHI, SSNs, bank/credit card numbers, driver's licenses, biometric data, and passports for 16,366 individuals (including 1 SC resident). Notifications sent Oct 12, 2018.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 116 days

discovery → filing · 25 days

May 31, 2018

Begins

Sep 24, 2018

Discovered

Oct 19, 2018

Filed

vs. sector median

7 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed16,366 affectedView incident

Name: Ransom Memorial Hospital
norm: ransom memorial hospital

Name: Ransom Memorial Hospital
norm: ransom memorial hospital
Industry: Healthcarellm

Discovered: Sep 24, 2018
Breach occurred: May 31, 2018 – Jun 11, 2018
Undetected for: 116 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 12, 2018
Affected individuals: 16,366state + nationwide
Data types: PHIGovernment IDIdentity (basic)Financial accountBiometric
Data elements: Social Security number
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Initial access: phishing_link

During the incident: Worked with data privacy experts and other professionals
Notified the affected individuals in writing
Offered all affected persons credit monitoring for one year at Ransom Memorial’s expense
Changed the account Passwords and Usernames for all affected accounts
Retained forensic IT assistance to conduct a detailed audit
Implemented Additional Security for WorkStation Security and Access Controls for all Employees
Retained a forensic firm to Perform an additional Security audit to implement new Security Procedures
Changes made: Implemented new security policies
Adopted new security measures and encryption technology
Additional security training procedures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 25 days(25 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2018/RansomHospital.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 19, 2018
Raw hash: 90261a05050313e10e20a7adaae399bd90f2882b5168bc3511aaed06dd6a251c

Reporting entityRansom Memorial Hospital

Victim entityRansom Memorial Hospital

Incidentdiscovered Sep 24, 2018

Stated responseWorked with data privacy experts and other professionals

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceconsumer.sc.gov