Social EngineeringHealthcareHealthcarePhishingMulti-Stage ChainCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Health (basic)PHILowActive

Children's Mercy Kansas City

bd_5dfb7d56d9364c3e · schema v1 · pii pii-v1

Severity

Low

Discovered

Dec 2, 2017

Filed

Apr 30, 2018

To disclose

21 weeks

Affected

3state residents only

Linked

3 filings

Confidence

65%

Children's Mercy Kansas City notified patients and staff of a phishing incident affecting five employee email accounts between Dec 2017 and Jan 2018. Unauthorized access led to the download of mailbox contents, exposing PHI and PII (names, MRNs, DOB, etc.) of potentially affected patients. The company reset accounts, engaged forensic experts, and provided 12 months of identity protection.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 21 weeks / 149 days

Dec 2, 2017

Begins

Dec 2, 2017

Discovered

Apr 30, 2018

Filed

vs. sector median

+10 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

New Hampshire State AGbd_2cce272c9ebd9b312018-04-30Verified
Massachusetts State AGbd_a929487dab3c7ff12018-04-30Verified

Name: Children's Mercy Kansas City
norm: childrens mercy
Domain: childrensmercy.org

Name: Children's Mercy Kansas City
norm: childrens mercy
Domain: childrensmercy.org
Industry: Healthcarellm

Discovered: Dec 2, 2017
Breach occurred: Dec 2, 2017 – Jan 3, 2018
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 30, 2018
Affected individuals: 3state-resident count only
Data types: Identity (basic)Health (basic)PHI
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing Link
Threat actor: ExternalFinancial
Regulator citations: Notified Department of Health and Human Services, Office of Civil Rights, Region VII
Initial access: phishing_link

During the incident: Reset compromised accounts the same day
Engaged outside security experts
Investigating to determine what contents were accessed
Notifying individuals as review continues
Offered 12 months of AllClear ID identity protection at no cost
Changes made: Re-education and re-training of key staff on internet scams such as phishing emails
Mandatory ongoing education for all employees regarding data security and privacy
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 21 weeks(149 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

New Hampshire State AGApr 30 · first

Massachusetts State AGApr 30 · first

Montana State AGApr 30 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/Childrens-Mercy-Hospital-2.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 30, 2018
Raw hash: 815b15ee9389b73f669aef9a3827a67ed32668e9bb5621a50b964140cdf66b18

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityChildren's Mercy Kansas City

Victim entityChildren's Mercy Kansas City

Incidentdiscovered Dec 2, 2017

Stated responseReset compromised accounts the same day

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov