HackingHealthcareHealthcareStolen CredentialsSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)Government IDCredentialsMediumContained

Tallahassee Memorial HealthCare, Inc.

bd_7c57931b7f054d4b · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 26, 2018

Filed

Oct 17, 2018

To disclose

21 days

Affected

2state residents only

Linked

2 filings

Confidence

64%

Full breach record for Tallahassee Memorial HealthCare, Inc. →3 incidents on file

Tallahassee Memorial HealthCare, Inc. notified Montana AG of a third-party vendor (Jobscience, Inc.) cyber-security attack exposing job applicant PII (names, addresses, SSNs, DOBs, credentials) from March 2005 to August 2018. Incident discovered Sept 26, 2018. Notices sent Oct 10, 2018. No misuse indicated. Credit monitoring offered.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 4957 days

discovery → filing · 21 days

Mar 1, 2005

Begins

Sep 26, 2018

Discovered

Oct 17, 2018

Filed

vs. sector median

7 wks faster

This filing is one of 2 filings about the same incident.View merged incident

Part of JobScience supply-chain incident (2018) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

New Hampshire State AGbd_c905d774c8d2e7002018-10-18 · +1dVerified

Name: Tallahassee Memorial HealthCare, Inc.
norm: tallahassee memorial healthcare

Name: Tallahassee Memorial HealthCare, Inc.
norm: tallahassee memorial healthcare
Industry: Healthcarellm

Discovered: Sep 26, 2018
Breach occurred: Mar 1, 2005 – Aug 31, 2018
Undetected for: 4,957 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 10, 2018
Affected individuals: 2state-resident count only
Data types: Identity (basic)Government IDCredentials
Data elements: Social Security numberDate of birth
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain CompromiseT1078 Valid Accounts
Threat actor: External
Third party: via Jobscience, Inc.
Initial access: supply_chain

During the incident: Offering complimentary one-year membership in Experian’s IdentityWorksSM Credit 3B
Working with Jobscience, Inc. to take steps to prevent a similar occurrence
Re-evaluating business relationship with Jobscience, Inc.
Changes made: Forcing password resets
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 21 days(21 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Montana State AGOct 17 · first · this page

New Hampshire State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/Tallahassee-Memorial-Healthcare.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 17, 2018
Raw hash: 93ebcf33919b225ef2bb91f731aa4c46139a9cd38d60c199afcd85de9683cc14

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityTallahassee Memorial HealthCare, Inc.

Victim entityTallahassee Memorial HealthCare, Inc.

Incidentdiscovered Sep 26, 2018

Stated responseOffering complimentary one-year membership in Experian’s IdentityWorksSM Credit 3B

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov