MisuseHealthcareHealthcareData MishandlingCustomer Data InvolvedMulti-Stage ChainFinancial accountHealth (basic)Identity (basic)PHILowActive

Providence

bd_7401dea24e1b6896 · schema v1 · pii pii-v1

Severity

Low

Discovered

Feb 11, 2026

Filed

Apr 16, 2026

To disclose

9 weeks

Affected

838state residents only

Linked

2 filings

Confidence

70%

Full breach record for Providence →3 incidents on file

Providence reported unauthorized access and sharing of patient data via Health Gorilla HIE between Aug 2024 and Dec 2025. Discovered Feb 11, 2026. 838 WA residents affected. Data included names, DOB, addresses, insurance, and clinical records. No SSNs involved. Providence is offering 1 year of identity protection.

J jump to incidentP pin to compareR raw source

Washington clock⏱ WA AG >30d9 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 530 days

discovery → filing · 9 weeks / 64 days

Aug 30, 2024

Begins

Feb 11, 2026

Discovered

Apr 16, 2026

Filed

vs. sector median

2 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

California State AGbd_86f27f95fb99cb4b2026-04-16Verified

Name: Providence
norm: providence
Domain: providence.org

Name: Providence
norm: providence
Domain: providence.org
Industry: Healthcarellm

Discovered: Feb 11, 2026
Breach occurred: Aug 30, 2024 – Dec 8, 2025
Undetected for: 530 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 9, 2026
Affected individuals: 838state-resident count only
Data types: Identity (basic)Health (basic)Financial account
Data elements: NameDate of birthHealth insurance IDMedical information
WA-stated cause: Unauthorized Access
WA-stated duration: lifecycle 500+dexposure 400-499d
WA-stated discovery: Found after the fact
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: Partner
Regulator citations: Notified Washington Office of the Attorney General
Third party: via Health Gorilla
Initial access: trusted_relationship

During the incident: Reviewing how the data-sharing service was used
Working with technology partners to understand the issue
Ensuring proper safeguards are in place to protect patient information
Offering no-cost credit services to each affected individual
Changes made: Offering one year of no-cost identity protection services through IDX
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(64 days from discovery to filing)
Compliance flags: WA AG >30d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

California State AGApr 16 · first

Washington State AGApr 16 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM23732.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 16, 2026
Raw hash: 97cbab708846ddceb4eb2d556ba30d5e94e20146b93a9abcf5b7be9aa24a5b5b

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityProvidence

Victim entityProvidence

Incidentdiscovered Feb 11, 2026

Stated responseReviewing how the data-sharing service was used

ComplianceWA AG >30d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com