PhysicalHealthcareHealthcareTheftCustomer Data InvolvedPIIHealth (basic)Identity (basic)LowResolved

St. Luke's Cornwall Hospital

bd_852ddf8e044dc80d · schema v1 · pii pii-v1

Severity

Low

Discovered

Oct 31, 2015

Filed

Dec 30, 2015

To disclose

9 weeks

Affected

1state residents only

Linked

2 filings

Confidence

65%

Full breach record for St. Luke's Cornwall Hospital →

St. Luke's Cornwall Hospital notified Montana residents of a physical theft of a USB thumb drive containing names, medical record numbers, and service dates. The incident occurred on October 31, 2015. Law enforcement was notified, and affected individuals were offered 12 months of identity theft recovery services. No SSNs or electronic medical records were exposed.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 9 weeks / 60 days

Oct 31, 2015

Begins

Oct 31, 2015

Discovered

Dec 30, 2015

Filed

vs. sector median

2 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

HHS OCRbd_6a5612f32262315c2015-12-30Candidate

Name: St. Luke's Cornwall Hospital
norm: st luke s cornwall hospital

Name: St. Luke's Cornwall Hospital
norm: st luke s cornwall hospital
Industry: Healthcarellm

Discovered: Oct 31, 2015
Breach occurred: Oct 31, 2015
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 22, 2015
Affected individuals: 1state-resident count only
Data types: PIIHealth (basic)Identity (basic)
Attack vector: Unknown
MITRE ATT&CK: T1052 Exfiltration Over Physical Medium
Threat actor: ExternalFinancial
Regulator citations: Notified law enforcement

During the incident: Notified law enforcement and is cooperating with their investigation
Offering identity theft recovery services through ID Experts
Requiring passwords and encryption protection for all thumb drives
Implementation of new systems that do not require the use of thumb drives or other mobile media devices
Changes made: Requiring passwords and encryption protection for all thumb drives
Implementation of new systems that do not require the use of thumb drives or other mobile media devices
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(60 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

HHS OCRDec 30 · first

Montana State AGDec 30 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/St.-Lukes-Cornwall-Hospital.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 30, 2015
Raw hash: 305c2cf6ffc5121000d313d1f1998ac467e6f090168c0efde4dce2d70df432d2

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entitySt. Luke's Cornwall Hospital

Victim entitySt. Luke's Cornwall Hospital

Incidentdiscovered Oct 31, 2015

Stated responseNotified law enforcement and is cooperating with their investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov