Social EngineeringHealthcareHealthcarePhishingCustomer Data InvolvedEmployee Data InvolvedPHIHealth (basic)Identity (basic)Government IDMediumContained

Community Memorial Health System

bd_5f791db51475fcd1 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 23, 2017

Filed

Sep 5, 2017

To disclose

11 weeks

Affected

Not disclosed

Linked

2 filings

Confidence

65%

Full breach record for Community Memorial Health System →6 incidents on file

Community Memorial Health System reported that an employee's email account was compromised via a phishing email on June 22, 2017. The employee noticed anomalies on June 23, 2017, leading to a password reset and investigation. The compromised account contained patient names, medical record numbers, dates of service, and certain health information. Some records may have included Social Security Numbers. Forensic analysis indicated it is highly unlikely personal information was accessed, but notice was provided as a precaution. Credit monitoring was offered.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 1 days

discovery → filing · 11 weeks / 74 days

Jun 22, 2017

Begins

Jun 23, 2017

Discovered

Sep 5, 2017

Filed

vs. sector median

2 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

HHS OCRbd_0c534258effa10842017-09-05Verified by operator

Name: Community Memorial Health System
norm: community memorial health system

Name: Community Memorial Health System
norm: community memorial health system
Industry: Healthcarellm

Discovered: Jun 23, 2017
Breach occurred: Jun 22, 2017
Undetected for: 1 dayoccurrence → discovery
Materiality determined: —
Notification sent: Sep 5, 2017
Affected individuals: Not disclosed
Data types: PHIHealth (basic)Identity (basic)Government ID
Data elements: Social Security numberMedical information
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1114 Email Collection
Threat actor: External
Initial access: phishing_link

During the incident: Temporarily disabling all external access to CMHS' e-mail system
Ensuring the affected employee updated their e-mail account with a new complex password
Engaging a consultant to conduct forensics on the compromised e-mail account
Updating its risk analysis
Deploying additional alerts and monitoring tools within its server environment
Providing its workforce members with additional training regarding phishing emails
Offering affected individuals identity theft protection and credit monitoring services for 24 months at no cost to the patient through AllClear ID
Changes made: Providing its workforce members with additional training regarding phishing emails
Deploying additional alerts and monitoring tools within its server environment
Updating its risk analysis
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 11 weeks(74 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings

View merged incident ↗

HHS OCRSep 5 · first

California State AGSep 5 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-101618
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 5, 2017
Raw hash: 8af41b78a185dff17fa40842177dae2d59f81841a7a4ded47675a9e5e3781556

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityCommunity Memorial Health System

Victim entityCommunity Memorial Health System

Incidentdiscovered Jun 23, 2017

Stated responseTemporarily disabling all external access to CMHS' e-mail system

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov