Social EngineeringHealthcareHealthcarePhishingData ExfiltratedCustomer Data InvolvedDelayed DiscoveryPHIHealth (basic)Identity (basic)MediumContained

Spokane Regional Health District

bd_87a3ffcfaa82cd97 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 24, 2022

Filed

Mar 21, 2022

To disclose

25 days

Affected

1,260state residents only

Confidence

69%

Full breach record for Spokane Regional Health District →2 incidents on file

Spokane Regional Health District (SRHD) reported a phishing incident affecting 1,260 Washington residents. On Feb 23, 2022, an employee clicked a malicious link, compromising Office 365 credentials. SRHD discovered the breach on Feb 24, 2022, and notified the WA Attorney General on March 21, 2022. Affected PHI included names, DOB, and medical details. SRHD reset credentials, provided training, and notified affected individuals.

J jump to incidentP pin to compareR raw source

Washington clock✓ WA AG ≤30d25 days discovery → filing

Incident timeline

undetected · 1 days

discovery → filing · 25 days

Feb 23, 2022

Begins

Feb 24, 2022

Discovered

Mar 21, 2022

Filed

vs. sector median

7 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1,260 affectedView incident

Name: Spokane Regional Health District
norm: spokane regional health district
Domain: srhd.org

Name: Spokane Regional Health District
norm: spokane regional health district
Domain: srhd.org
Industry: Healthcarellm

Discovered: Feb 24, 2022
Breach occurred: Feb 23, 2022
Undetected for: 1 dayoccurrence → discovery
Materiality determined: —
Notification sent: Mar 21, 2022
Affected individuals: 1,260state-resident count only
Data types: PHIHealth (basic)Identity (basic)
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing Link
Threat actor: ExternalFinancial
Regulator citations: Notified Washington State Attorney General’s Office
Initial access: phishing_link

During the incident: Logged affected staff out of all Office 365 sessions
Reset their password
Assisted the staff member with resetting their password and re-registering their multi-factor authentication device
Provided one-on-one training
Sent notification letters to affected clients
Sent notice to local media
Posted notice on website
Notified Washington State Attorney General’s Office
Changes made: Rolled out 2022 training plan including mandatory training, phishing tests, and cyber education
Review of Data Loss Prevention technical controls and policies affecting data storage systems is underway
Implementing additional technical controls and training for staff
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 25 days(25 days from discovery to filing)
Compliance flags: WA AG ≤30d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA5397.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 21, 2022
Raw hash: 971846911ca805100fc8e67718d522c9e874bd97abb0f3896162f45d15694b85

Reporting entitySpokane Regional Health District

Victim entitySpokane Regional Health District

Incidentdiscovered Feb 24, 2022

Stated responseLogged affected staff out of all Office 365 sessions

ComplianceWA AG ≤30d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com