FEDERALItem 7.01 · voluntary (Reg FD)HackingHealthcareHealthcareSupply Chain (3P Vendor)Delayed DiscoveryLowActive

Encompass Health Corporation

bd_7f8eb86513c7a086 · schema v1 · pii pii-v1

Severity

Low

Discovered

Feb 21, 2024

Filed

Feb 27, 2024

To disclose

6 days

Affected

Not disclosed

Confidence

67%

Full breach record for Encompass Health Corporation →2 incidents on file

Encompass Health Corporation filed an 8-K on Feb 27, 2024, reporting a cybersecurity incident involving Change Healthcare, a third-party payment claims intermediary. Encompass severed connections and conducted forensic searches but found no unauthorized access to its own systems. The incident has not affected patient care, though claim submission delays may occur. Encompass does not currently consider the incident material.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 6 days

Feb 21, 2024

Discovered

Feb 27, 2024

Filed

vs. sector median

12 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: Encompass Health Corporation
norm: encompass health
SEC CIK: 0000785161
Domain: encompasshealth.com

Name: Encompass Health Corporation
norm: encompass health
SEC CIK: 0000785161
Domain: encompasshealth.com
Industry: Healthcarellm

Discovered: Feb 21, 2024
Materiality determined: Feb 27, 2024
Notification sent: —
Affected individuals: Not disclosed
Data types: —
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain Compromise
Threat actor: External
Third party: via Change Healthcarepayment claims intermediary
Initial access: supply_chain

During the incident: Severed business service connections between the Company's systems and Change Healthcare's
Conducting forensics on its systems, including searching for known indicators of compromise
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 days(6 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filing

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statementThis record

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.sec.gov/Archives/edgar/data/785161/000078516124000006/ehc-20240227.htm
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Feb 27, 2024
Raw hash: e6261c089199de41822d9588851ddd2b35e8fdfb30a514aeadccc92e157bac8e

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html22.2 KB

Download View at source

Reporting entityEncompass Health Corporation

Victim entityEncompass Health Corporation

Incidentdiscovered Feb 21, 2024

Stated responseSevered business service connections between the Company's systems and Change Healthcare's

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancewww.sec.gov

Source filing