HackingHealthcareHealthcareSupply Chain (3P Vendor)Customer Data InvolvedPHIGovernment IDIdentity (basic)Financial accountHealth (basic)EmploymentMediumContained

SAC Health System

bd_7d4195b106c8675f · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 15, 2021

Filed

May 10, 2021

To disclose

16 weeks

Affected

Not disclosed

Linked

3 filings

Confidence

66%

Full breach record for SAC Health System →2 incidents on file

SAC Health System notified individuals that a third-party service provider, Netgain Technology, LLC, experienced a data security incident resulting in unauthorized access to servers containing SAC Health System's medical record database between November 15, 2020, and November 22, 2020. SAC Health System was notified by Netgain on January 15, 2021. Affected data included names, addresses, Social Security numbers, dates of birth, driver's license numbers, financial account information, and medical history. SAC Health System ceased using Netgain, is removing data from their systems, and is offering credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 61 days

discovery → filing · 16 weeks / 115 days

Nov 15, 2020

Begins

Jan 15, 2021

Discovered

May 10, 2021

Filed

vs. sector median

+5 wks slower

This filing is one of 3 about the same incident.View merged incident

Part of Netgain Networks supply-chain incident (2021) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

HHS OCRbd_25dfe718971094302021-05-10Verified by operator
Indiana State AGbd_f5d9f216573023702021-05-07 · +3dVerified

Name: SAC Health System
norm: sac health system

Name: SAC Health System
norm: sac health system
Industry: Healthcarellm

Discovered: Jan 15, 2021
Breach occurred: Nov 15, 2020 – Nov 22, 2020
Undetected for: 61 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: PHIGovernment IDIdentity (basic)Financial accountHealth (basic)Employment
Attack vector: Third-Party / Supply Chain
Threat actor: External
Regulator citations: Provided notice to appropriate regulatory authorities
Third party: via Netgain Technology, LLC
Initial access: supply_chain

During the incident: Immediately began working with Netgain to determine the nature and scope of this potential access
Launched its own independent investigation into this matter
Undertook a review of the data at issue
Provided notice to appropriate regulatory authorities
Offering access to complimentary credit monitoring through Equifax
Changes made: No longer using Netgain as a service provider
Working on removing all data from the Netgain systems
Assessing policies and procedures related to the use of third-party service providers
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 16 weeks(115 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 2 states

View merged incident ↗

Indiana State AGMay 7 · first

HHS OCR+3d

California State AG+3d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-540710
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 10, 2021
Raw hash: 0cf557d6b56318755f35407f3c9f9359184329c829998328f0efe961d1390e18

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entitySAC Health System

Victim entitySAC Health System

Incidentdiscovered Jan 15, 2021

Stated responseImmediately began working with Netgain to determine the nature and scope of this potential access

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov