HackingHealthcareHealthcareSupply Chain (3P Vendor)Employee Data InvolvedDelayed DiscoveryPIIIDENTITY_BASICIDENTITY_GOVERNMENTEMPLOYMENTFINANCIALMediumActive
Marshall
bd_73919346f5bdd1c5 · schema v1 · pii pii-v1
Full breach record for Marshall →Marshall Medical Center (MMC) notified employees of a data breach involving its payroll vendor PaperlessPay. On February 18, 2020, an unknown actor accessed PaperlessPay's database containing MMC employee payroll data including names, addresses, pay/withholdings, and Social Security numbers. DHS alerted PaperlessPay on February 19, 2020, and MMC was notified on March 20, 2020. A joint DHS/FBI investigation is ongoing. PaperlessPay rebuilt its infrastructure; MMC is transitioning to Workday payroll.
Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-189529
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Apr 28, 2020
- Raw hash
- 00fcee8ec0f73ea26abee63f5ddcfb3cae4ed4cf56d9cede7b3be7bed49419e0
Reporting entity
- Name
- Marshallnorm: marshall
- Domain
- marshallmedical.org
Victim entity
- Name
- Marshallnorm: marshall
- Domain
- marshallmedical.org
- Industry
- Healthcarellm
Incident
- Discovered
- —
- Materiality determined
- —
- Notification sent
- Apr 27, 2020
- Affected individuals
- Not disclosed
- Data types
- PIIIDENTITY_BASICIDENTITY_GOVERNMENTEMPLOYMENTFINANCIAL
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1078 Valid AccountsT1530 Data from Cloud Storage Object
- Threat actor
- ExternalFinancial
- Regulator citations
- Department of Homeland Security (DHS) notified PaperlessPay on February 19, 2020 of potential dark web sale of database accessJoint investigation conducted by DHS and FBI; investigation is ongoing
- Third party
- via PaperlessPay
Compliance
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.