HackingHealthcareHealthcareStolen CredentialsCustomer Data InvolvedEmployee Data InvolvedPIIPHIIdentity (basic)Health (basic)LowActive

Covenant Care California, LLC

bd_6dec4a99bf50f3f1 · schema v1 · pii pii-v1

Severity

Low

Discovered

Feb 1, 2022

Filed

Jun 22, 2022

To disclose

20 weeks

Affected

Not disclosed

Linked

4 filings

Confidence

66%

Full breach record for Covenant Care California, LLC →8 incidents on file

Covenant Care California, LLC disclosed that an unauthorized actor gained access to certain employee email accounts associated with its Home Health services between February 24 and March 22, 2022. The company identified suspicious activity in February 2022. The incident potentially exposed patient and responsible party information, including names and health-related data. Covenant Care engaged forensic investigators, secured accounts, and is offering 12 months of identity monitoring via Kroll. The investigation is ongoing.

J jump to incidentP pin to compareR raw source

Incident timeline

Feb 24, 2022

Begins

Jun 22, 2022

Filed

vs. sector median

+8 wks slower

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

California State AGbd_444697bec78f4b282022-05-09 · +44dVerified
HHS OCRbd_7661bb914420c3db2022-05-06 · +47dVerified
Montana State AGbd_7b0ab00c082509be2022-05-06 · +47dVerified

Name: Covenant Care California, LLC
norm: covenant care california

Name: Covenant Care California, LLC
norm: covenant care california
Industry: Healthcarellm

Discovered: Feb 1, 2022
Breach occurred: Feb 24, 2022 – Mar 22, 2022
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: PIIPHIIdentity (basic)Health (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: External
Regulator citations: Reporting this incident to law enforcement and appropriate state and federal regulators
Initial access: valid_credentials

During the incident: Secured the affected email accounts
Commenced an investigation into the activity
Working with forensic investigators and other third-party vendors to assist with the investigation, mitigation, and remediation activities
Reporting this incident to law enforcement and appropriate state and federal regulators
Offering access to twelve (12) months of identity monitoring services at no cost to you through Kroll
Changes made: Reviewing technical, administrative, and physical safeguards to identify and implement any potential enhancements to its security measures
Installation of additional technical safeguards to our email systems
Reviewing general privacy and security policies and procedures for potential enhancements
Reviewing policies and procedure specific to employee training on email security
Conducting additional employee retraining regarding email safety and security awareness
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 20 weeks(141 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 2 states

View merged incident ↗

HHS OCRMay 6 · first

Montana State AGMay 6 · first

California State AG+3d

California State AG+47d · this page

Pattern: first filing May 6 (CA), last Jun 22 (CA) — a 47-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-554499
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 22, 2022
Raw hash: e6c19521fade6f41629cdd811dd68b39a2f893ede67f174809ca922ca6328fc9

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityCovenant Care California, LLC

Victim entityCovenant Care California, LLC

Incidentdiscovered Feb 1, 2022

Stated responseSecured the affected email accounts

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov