Social EngineeringHealthcareHealthcarePhishingStolen CredentialsData ExfiltratedCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDFinancial accountHealth (basic)PHIHighContained

Upstream RollCo, LLC

bd_8071615219b7efc6 · schema v1 · pii pii-v1

Severity

High

Discovered

Feb 9, 2023

Filed

Sep 15, 2023

To disclose

31 weeks

Affected

14,247state residents only

Linked

5 filings

Confidence

71%

Full breach record for Upstream RollCo, LLC →3 incidents on file

Upstream RollCo, LLC notified Washington residents of a cyberattack where unauthorized parties accessed employee email accounts containing PHI, SSNs, and financial data between Jan 24 and Feb 9, 2023. 14,247 residents were notified on Sept 15, 2023. Credit monitoring was offered.

J jump to incidentP pin to compareR raw source

Washington clock✗ WA AG >90d31 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 16 days

discovery → filing · 31 weeks / 218 days

Jan 24, 2023

Begins

Feb 9, 2023

Discovered

Sep 15, 2023

Filed

vs. sector median

+22 wks slower

This filing is one of 5 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Massachusetts State AGbd_432d3d9e118718422023-09-15Verified
Montana State AGbd_481d77655f615c692023-09-15Candidate
California State AGbd_7e4d484b6d371f422023-09-15Verified
South Carolina State AGbd_e187942d38538bbc2023-09-18 · +3dVerified

Name: Upstream RollCo, LLC
norm: upstream rollco

Name: Upstream RollCo, LLC
norm: upstream rollco
Industry: Healthcarellm

Discovered: Feb 9, 2023
Breach occurred: Jan 24, 2023 – Feb 9, 2023
Undetected for: 16 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 15, 2023
Affected individuals: 14,247state-resident count only
Data types: Identity (basic)Government IDFinancial accountHealth (basic)PHI
Data elements: NameSocial Security numberFinancial account numberDate of birthHealth insurance IDMedical information
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 1-99dexposure 1-99d
WA-stated discovery: Found while ongoingContained same day
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Regulator citations: providing written notice of this incident to relevant state and federal regulatorsnotifying the three major credit reporting agencies, Equifax, Experian, and TransUnionnotifying the U.S. Department of Health and Human Services and prominent media pursuant to the Health Insurance Portability and Accountability Act (HIPAA)
Initial access: phishing_link

During the incident: Investigated and responded to the activity
Assessed the security of Upstream RollCo LLC’s email
Identified potentially affected individuals
Providing access to credit monitoring services for one (1) year, through IDX
Providing impacted individuals with guidance on how to better protect against identity theft and fraud
Providing individuals with information on how to place a fraud alert and security freeze on one’s credit file
Providing written notice of this incident to relevant state and federal regulators
Notifying the three major credit reporting agencies, Equifax, Experian, and TransUnion
Notifying the U.S. Department of Health and Human Services and prominent media pursuant to the Health Insurance Portability and Accountability Act (HIPAA)
Changes made: Reviewing and enhancing existing policies and procedures to reduce the likelihood of a similar future event
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 31 weeks(218 days from discovery to filing)
Compliance flags: WA AG >90d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Massachusetts State AGSep 15 · first

Montana State AGSep 15 · first

California State AGSep 15 · first

Washington State AGSep 15 · first · this page

South Carolina State AG+3d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26493.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 15, 2023
Raw hash: 37c902079234c090243ba0c0d19483d3729ee88654f01a44a39adc1fe921f1e0

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityUpstream RollCo, LLC

Victim entityUpstream RollCo, LLC

Incidentdiscovered Feb 9, 2023

Stated responseInvestigated and responded to the activity

ComplianceWA AG >90d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com