HackingHealthcareHealthcareData ExfiltratedCustomer Data InvolvedIdentity (basic)Health (basic)PHILowContained

Jefferson County Health Center

bd_70a875ba37d0bab9 · schema v1 · pii pii-v1

Severity

Low

Discovered

May 30, 2023

Filed

Aug 2, 2023

To disclose

9 weeks

Affected

Not disclosed

Linked

6 filings

Confidence

67%

Full breach record for Jefferson County Health Center →

Jefferson County Health Center notified consumers on August 2, 2023, of a security incident discovered on May 30, 2023. An unknown actor accessed systems between April 24 and May 30, 2023, potentially exposing patient names, health insurance info, medical history, treatment info, and diagnoses. No evidence of misuse was found. JCHC secured systems, reported to federal law enforcement, and offered 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Vermont clock✗ VT AG >45 bday9 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 36 days

discovery → filing · 9 weeks / 64 days

Apr 24, 2023

Begins

May 30, 2023

Discovered

Aug 2, 2023

Filed

vs. sector median

3 wks faster

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitekarakurtbd_aa7c35c6750282c62023-07-03 · +30dVerified by operator

Regulatory filings (4) · sorted by filing gap

Massachusetts State AGbd_940c4ed69acbf5312023-08-02Verified by operator
HHS OCRbd_2393b488fc7d9bca2023-07-28 · +5dCandidate
HHS OCRbd_091e4e40981283452023-01-13 · +201dVerified by operator
Illinois State AGbd_d1ff68913b9175902023-01-01 · +213dVerified

Name: Jefferson County Health Center
norm: jefferson county health center

Name: Jefferson County Health Center
norm: jefferson county health center
Industry: Healthcarellm

Discovered: May 30, 2023
Breach occurred: Apr 24, 2023 – May 30, 2023
Undetected for: 36 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 2, 2023
Affected individuals: Not disclosed
Data types: Identity (basic)Health (basic)PHI
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Initial access: valid_credentials

During the incident: Moved quickly to secure the systems
Launched an investigation to determine the nature and scope of the activity
Undertook a thorough review of the impacted systems
Reported this event to federal law enforcement
Are assisting in their investigation
Reviewing our protocols, policies, and procedures
Notifying appropriate regulators
Offering you twelve (12) months of complimentary credit monitoring through Cyberscout
Changes made: Reviewing our protocols, policies, and procedures to reduce the likelihood of a similar event from occurring in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(64 days from discovery to filing)
Compliance flags: VT AG >45 bday
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Illinois State AGJan 1 · first

HHS OCR+12d

HHS OCR+208d

Massachusetts State AG+213d

Vermont State AG+213d · this page

Pattern: first filing Jan 1 (IL), last Aug 2 (VT) — a 213-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ago.vermont.gov/document/2023-08-02-jefferson-county-health-center-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 2, 2023
Raw hash: 569a3130f421768ba7c6b893e46641ed315edafc99c7bd060d6df31cb33c4cff

Linked disclosures

Ransomware claims (1)

Regulatory filings (4) · sorted by filing gap

Reporting entityJefferson County Health Center

Victim entityJefferson County Health Center

Incidentdiscovered May 30, 2023

Stated responseMoved quickly to secure the systems

ComplianceVT AG >45 bday

Extraction provenanceno artifact recorded

Source provenanceago.vermont.gov