HackingHealthcareHealthcareCustomer Data InvolvedDelayed DiscoveryPHIGovernment IDIdentity (basic)Health (basic)FinancialMediumContained

21st Century Oncology

bd_71143f2f3db9e047 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 13, 2015

Filed

Mar 4, 2016

To disclose

16 weeks

Affected

Not disclosed

Linked

8 records

Confidence

65%

Full breach record for 21st Century Oncology →

21st Century Oncology notified patients that an unauthorized third party may have accessed a database containing patient information, including names, Social Security numbers, physician names, diagnosis/treatment info, and insurance data. The intrusion occurred on October 3, 2015, but the company was notified by the FBI on November 13, 2015. Notification was delayed per FBI request. The company engaged forensic investigators, enhanced security protocols, and offered one year of identity protection services.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 41 days

discovery → filing · 16 weeks / 112 days

Oct 3, 2015

Begins

Nov 13, 2015

Discovered

Mar 4, 2016

Filed

vs. sector median

+7 wks slower

This filing is one of 8 records about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

Washington State AGbd_231b0f2f48d86b562016-03-04Verified
New Hampshire State AGbd_ed346a8482bd7a842016-03-04Verified
HHS OCRbd_fcbda5a17a2f0c7e2016-03-04Verified
Montana State AGbd_f97670eab77986b12016-03-14 · +10dVerified by operator

Show 2 more filings ↓up to 55d gap

Massachusetts State AGbd_8b2c60608960c1d32016-04-27 · +54dVerified
South Carolina State AGbd_527c87e1e91d5b942016-04-28 · +55dVerified

Enforcement records (1)

HHS OCR enforcementbd_d54ff290c72ee2482017-12-28 · +664dVerified by operator

Name: 21st Century Oncology
norm: 21st century oncology
Domain: 21co.com

Name: 21st Century Oncology
norm: 21st century oncology
Domain: 21co.com
Industry: Healthcarellm

Discovered: Nov 13, 2015
Breach occurred: Oct 3, 2015
Undetected for: 41 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: PHIGovernment IDIdentity (basic)Health (basic)Financial
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Federal Bureau of Investigation (FBI) advised us that patient information was illegally obtainedFBI asked that we delay notification or public announcement of the incident

During the incident: Hired a leading forensics firm to support our investigation, assess our systems and bolster security
Work closely with the FBI on its investigation of the intrusion into our system
Taken steps to enhance internal security protocols to help prevent a similar incident in the future
Offering a free one-year membership of Experian’s ProtectMyID Alert
Changes made: Taken steps to enhance internal security protocols to help prevent a similar incident in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 16 weeks(112 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 7 states

View merged incident ↗

Washington State AGMar 4 · first

New Hampshire State AGMar 4 · first

HHS OCRMar 4 · first

California State AGMar 4 · first · this page

Montana State AG+10d

Massachusetts State AG+54d

South Carolina State AG+55d

Pattern: first filing Mar 4 (WA), last Apr 28 (SC) — a 55-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-60307
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 4, 2016
Raw hash: 80663ea127ef9b5fccd9463c8a46b8c9e2036596681a5f84f696aa4a9d8d4678

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Enforcement records (1)

Reporting entity21st Century Oncology

Victim entity21st Century Oncology

Incidentdiscovered Nov 13, 2015

Stated responseHired a leading forensics firm to support our investigation, assess our systems and bolster security

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov