HackingHealthcareHealthcareSupply Chain (3P Vendor)Employee Data InvolvedDelayed DiscoveryPIIIdentity (basic)Government IDEmploymentFinancialMediumActive

Marshall

bd_73919346f5bdd1c5 · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Apr 28, 2020

To disclose

—

Affected

Not disclosed

Confidence

82%

Full breach record for Marshall →2 incidents on file

Marshall Medical Center (MMC) notified employees of a data breach involving its payroll vendor PaperlessPay. On February 18, 2020, an unknown actor accessed PaperlessPay's database containing MMC employee payroll data including names, addresses, pay/withholdings, and Social Security numbers. DHS alerted PaperlessPay on February 19, 2020, and MMC was notified on March 20, 2020. A joint DHS/FBI investigation is ongoing. PaperlessPay rebuilt its infrastructure; MMC is transitioning to Workday payroll.

J jump to incidentP pin to compareR raw source

Incident timeline

Feb 18, 2020

Begins

Apr 28, 2020

Filed

Part of PaperlessPay Corporation supply-chain incident (2020) — a supply-chain cascade affecting multiple organizations.View cascade →

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: Marshall
norm: marshall
Domain: marshallmedical.org

Name: Marshall
norm: marshall
Domain: marshallmedical.org
Industry: Healthcarellm

Discovered: —
Breach occurred: Feb 18, 2020
Materiality determined: —
Notification sent: Apr 27, 2020
Affected individuals: Not disclosed
Data types: PIIIdentity (basic)Government IDEmploymentFinancial
Data elements: Social Security number
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid AccountsT1530 Data from Cloud Storage Object
Threat actor: ExternalFinancial
Regulator citations: Department of Homeland Security (DHS) notified PaperlessPay on February 19, 2020 of potential dark web sale of database accessJoint investigation conducted by DHS and FBI; investigation is ongoing
Third party: via PaperlessPay

During the incident: PaperlessPay shut down its web server and database to prevent any potential unauthorized access
PaperlessPay cooperated with the joint investigation conducted by DHS and the FBI
PaperlessPay retained the cybersecurity firm Ankura to help with its own, internal forensic investigation of the incident
PaperlessPay rebuilt a new domain controller, a new web server, and a new database server
PaperlessPay restored database files to the new database server from backups
New IP addresses were assigned to all the new servers, and passwords for users and administrators were changed
Disabled all remote access capabilities to the new web server and database server
PaperlessPay installed an endpoint detection and response (EDR) application called Carbon Black on the new servers and other endpoints
MMC decided to stop sending any more information to this vendor going forward
Offering a complimentary one-year membership of Experian IdentityWorks Credit 3B to affected employees
Changes made: PaperlessPay rebuilt a new domain controller, a new web server, and a new database server to start with a clean slate
New IP addresses were assigned to all the new servers
Disabled all remote access capabilities to the new web server and database server
Installed Carbon Black EDR application on new servers and other endpoints to monitor all activity
MMC decided to stop sending any more information to PaperlessPay going forward
MMC purchased a new payroll system through Workday with an employee portal for paystub and W-2 access
MMC will be going back to producing paper paystubs until the new payroll system is live
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-189529
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 28, 2020
Raw hash: 00fcee8ec0f73ea26abee63f5ddcfb3cae4ed4cf56d9cede7b3be7bed49419e0

Reporting entityMarshall

Victim entityMarshall

IncidentThird-Party / Supply Chain

Stated responsePaperlessPay shut down its web server and database to prevent any potential unauthorized access

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov