MalwareHealthcareHealthcareRansomwareSupply Chain (3P Vendor)Data EncryptedCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Health (basic)PHIMediumResolved

Grays Harbor Community Hospital

bd_7daa9a05a2b79776 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 29, 2020

Filed

Jan 29, 2021

To disclose

9 weeks

Affected · nationwide

5,1364,984 in this filing

Confidence

70%

Full breach record for Grays Harbor Community Hospital →2 incidents on file

Grays Harbor Community Hospital (GHCH) notified the Washington AG of a ransomware attack on its mail-processing vendor, Metro Presort, Inc. (MPI). The attack occurred May 6-15, 2019. GHCH was notified by MPI on Nov 29, 2020. Patient data (names, DOB, health plan IDs, treatment dates) was potentially accessible. ~5,136 patients affected. No evidence of actual improper access. OCR investigated and closed in Dec 2020.

J jump to incidentP pin to compareR raw source

Washington clock⏱ WA AG >30d9 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 573 days

discovery → filing · 9 weeks / 61 days

May 6, 2019

Begins

Nov 29, 2020

Discovered

Jan 29, 2021

Filed

vs. sector median

4 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed5,136 affectedView incident

Name: Grays Harbor Community Hospital
norm: grays harbor community hospital

Name: Grays Harbor Community Hospital
norm: grays harbor community hospital
Industry: Healthcarellm

Discovered: Nov 29, 2020
Breach occurred: May 6, 2019 – May 15, 2019
Undetected for: 573 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 29, 2021
Affected individuals: 5,136state + nationwide
Data types: Identity (basic)Health (basic)PHI
Data elements: NameDate of birthMedical information
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 500+dexposure 1-99d
WA-stated discovery: Found after the fact
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1195 Supply Chain Compromise
Threat actor: ExternalFinancial
Regulator citations: U.S. Department of Health and Human Services, Office for Civil Rights (OCR) investigated the incidentOCR closed its investigation of the matter on December 31, 2020
Third party: via Metro Presort, Inc.
Initial access: supply_chain

During the incident: Notified law enforcement and is cooperating with their investigation
Created a web page addressing the incident
Provided written notice of the data security incident to affected patients
Issued a press release about the incident to prominent print media outlets
Provided notice to the Secretary of Health and Human Services on GHCH’s behalf about the incident
Reviewed its own security protocols and safeguards to protect the information maintained in its systems
Changes made: Implemented additional technical safeguards to prevent similar incidents in the future
Implemented additional protections (encryption) of customer files
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(61 days from discovery to filing)
Compliance flags: WA AG >30d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10356.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 29, 2021
Raw hash: 8a9c271fb80b67939bcac6f2bafc0a282eabfcaaf24e4ddd063c84af76b83a8b

Reporting entityGrays Harbor Community Hospital

Victim entityGrays Harbor Community Hospital

Incidentdiscovered Nov 29, 2020

Stated responseNotified law enforcement and is cooperating with their investigation

ComplianceWA AG >30d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com