Social EngineeringHealthcareHealthcarePhishingStolen CredentialsTargetedCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDPHIHealth (basic)HighResolved

Seattle Indian Health Board

bd_5fbce73035e26e27 · schema v1 · pii pii-v1

Severity

High

Discovered

Aug 10, 2016

Filed

May 9, 2017

To disclose

39 weeks

Affected

4,579state residents only

Confidence

69%

Full breach record for Seattle Indian Health Board →2 incidents on file

Seattle Indian Health Board reported a cyberattack on an employee email account on August 10, 2016. A hacker from Nigeria accessed the account via phishing, sending spam blasts. The incident was contained the same day. The breach may have exposed PHI, including names, DOBs, SSNs, and patient IDs, affecting 4,579 Washington residents. SIHB forced password resets and is migrating to Office 365.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 39 weeks / 272 days

Aug 10, 2016

Begins

Aug 10, 2016

Discovered

May 9, 2017

Filed

vs. sector median

+28 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed4,579 affectedView incident

Name: Seattle Indian Health Board
norm: seattle indian health board
Domain: sihb.org

Name: Seattle Indian Health Board
norm: seattle indian health board
Domain: sihb.org
Industry: Healthcarellm

Discovered: Aug 10, 2016
Breach occurred: Aug 10, 2016
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 7, 2016
Affected individuals: 4,579state-resident count only
Data types: Identity (basic)Government IDPHIHealth (basic)
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 0dexposure 0d
WA-stated discovery: Found while ongoingContained same day
Attack vector: Phishing
MITRE ATT&CK: T1078 Valid AccountsT1566.002 Spearphishing Link
Threat actor: ExternalFinancial
Initial access: phishing_link

During the incident: Shut down SIHB’s Zimbra email system to terminate the hacker’s access
Changed all user passwords to prevent future logins by the hacker(s)
Examined the Zimbra system logs to assess the nature and extent of the incident
Launched an in-depth investigation to evaluate the extent of this incident
Changes made: Forced a password change for every SIHB end-user
Working to implement more structured password management and control measures
Educated staff members about the importance of password safety
Working on a project to move all end-users to Microsoft Office 365 email with HIPAA compliance rulesets
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 39 weeks(272 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9699.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 9, 2017
Raw hash: fd7c6742151971667a9e7e260952495a80cf67cfc1138a22a4b476327c2e6da2

Reporting entitySeattle Indian Health Board

Victim entitySeattle Indian Health Board

Incidentdiscovered Aug 10, 2016

Stated responseShut down SIHB’s Zimbra email system to terminate the hacker’s access

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com