HackingHealthcareHealthcareSupply Chain (3P Vendor)Employee Data InvolvedDelayed DiscoveryPIIIdentity (basic)Government IDFinancial accountEmploymentMediumContained

Community Memorial Health System

bd_5b3d82eb2f92ba2a · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Apr 27, 2020

To disclose

—

Affected

Not disclosed

Confidence

76%

Full breach record for Community Memorial Health System →6 incidents on file

Community Memorial Health System (CMHS) notified employees of a data breach at third-party vendor PaperlessPay Corporation. DHS alerted PaperlessPay on February 19, 2020 that an unknown individual was selling access to their client database on the dark web. The unauthorized person accessed PaperlessPay's SQL server on February 18, 2020, where CMHS employee pay stub and tax form data was stored, including names, addresses, SSNs, pay/withholdings, and in some cases bank account numbers. CMHS offered one year of free Experian IdentityWorks to affected employees.

J jump to incidentP pin to compareR raw source

Incident timeline

Feb 18, 2020

Begins

Apr 27, 2020

Filed

Part of PaperlessPay Corporation supply-chain incident (2020) — a supply-chain cascade affecting multiple organizations.View cascade →

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: Community Memorial Health System
norm: community memorial health system

Name: Community Memorial Health System
norm: community memorial health system
Industry: Healthcarellm

Discovered: —
Breach occurred: Feb 18, 2020
Materiality determined: —
Notification sent: Apr 27, 2020
Affected individuals: Not disclosed
Data types: PIIIdentity (basic)Government IDFinancial accountEmployment
Data elements: Social Security number
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Department of Homeland Security (DHS) notified PaperlessPay of possible breach and conducted joint investigation with FBIFederal Bureau of Investigation (FBI) conducted joint investigation with DHSNotified California Attorney General
Third party: via PaperlessPay Corporation
Initial access: exploit_public_facing

During the incident: PaperlessPay shut down their web server and SQL server to prevent potential unauthorized access
PaperlessPay cooperated with the joint investigation conducted by DHS and the Federal Bureau of Investigation (FBI)
PaperlessPay retained a cybersecurity firm to help with their own internal forensic investigation of the incident
Asked PaperlessPay to reset all passwords
Working with PaperlessPay to understand the full scope of the incident and to ensure that CMHS information is secure moving forward
CMHS has arranged for affected individuals to register for identity theft protection and credit monitoring services for one year at no cost to the employee through Experian's IdentityWorks
Changes made: PaperlessPay has taken several steps to improve the security of their systems
Offered one-year complimentary membership of Experian's IdentityWorks to affected individuals
Recommended affected employees change the password/access information for their payroll account
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-189495
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 27, 2020
Raw hash: 417afb1e25bb836d5514f2c602ef97ef9502932c85b48b8ccf8dff91aec47a34

Reporting entityCommunity Memorial Health System

Victim entityCommunity Memorial Health System

IncidentThird-Party / Supply Chain

Stated responsePaperlessPay shut down their web server and SQL server to prevent potential unauthorized access

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov