AccidentalHealthcareHealthcareMisconfigurationDelayed DiscoveryIdentity (basic)Health (basic)PIILowContained

Children's Minnesota

bd_6d4c32c5fc8044bb · schema v1 · pii pii-v1

Severity

Low

Discovered

Aug 26, 2019

Filed

Oct 25, 2019

To disclose

9 weeks

Affected

2state residents only

Linked

2 filings

Confidence

66%

Full breach record for Children's Minnesota →5 incidents on file

Children's Minnesota notified patients that internal employee calendars, configured to be viewable outside secure systems, may have exposed limited demographic and clinical information (names, account numbers, appointment details, provider names) dating back to December 2011. The misconfiguration was discovered and corrected on August 26, 2019. It was undetermined if unauthorized persons viewed the data. No other systems were affected.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 2825 days

discovery → filing · 9 weeks / 60 days

Dec 1, 2011

Begins

Aug 26, 2019

Discovered

Oct 25, 2019

Filed

vs. sector median

3 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

HHS OCRbd_31b4e492f1d9a6ca2019-10-25Verified

Name: Children's Minnesota
norm: children s minnesota

Name: Children's Minnesota
norm: children s minnesota
Industry: Healthcarellm

Discovered: Aug 26, 2019
Breach occurred: Dec 1, 2011
Undetected for: 2,825 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 25, 2019
Affected individuals: 2state-resident count only
Data types: Identity (basic)Health (basic)PII
Attack vector: Misconfiguration
MITRE ATT&CK: T1190 Exploit Public-Facing Application

During the incident: Corrected the configuration
Began an investigation
Engaged a computer forensic firm to assist with the data analysis
Changes made: Reviewing our security policies and procedures
Retraining our staff to protect against future incidents
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(60 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

HHS OCROct 25 · first

Montana State AGOct 25 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/General-Notice-15.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 25, 2019
Raw hash: 8b836701ed6ac4cd9304ce52a092a87efe779fe16ed1412b7108cf1f4403032a

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityChildren's Minnesota

Victim entityChildren's Minnesota

Incidentdiscovered Aug 26, 2019

Stated responseCorrected the configuration

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov