Social EngineeringHealthcareHealthcarePretextingStolen CredentialsTargetedData ExfiltratedIdentity (basic)Health (basic)PHILowContained

University of Michigan/Michigan Medicine

bd_8e7f082582924695 · schema v1 · pii pii-v1

Severity

Low

Discovered

May 23, 2024

Filed

Jul 31, 2024

To disclose

10 weeks

Affected

Not disclosed

Linked

2 filings

Confidence

66%

Full breach record for University of Michigan/Michigan Medicine →11 incidents on file

Michigan Medicine reported a cyberattack between May 23-29, 2024, where attackers used pretexting to compromise three employee email accounts. Compromised emails contained patient PHI including names, medical record numbers, DOBs, and treatment info. No SSNs or financial data were involved. The incident was contained, reported to law enforcement and HHS OCR.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 10 weeks / 69 days

May 23, 2024

Begins

May 23, 2024

Discovered

Jul 31, 2024

Filed

vs. sector median

+1 wks slower

This filing is one of 2 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

HHS OCRbd_4122177d23ffa0e82024-07-19 · +12dVerified

Name: University of Michigan/Michigan Medicine
norm: university of michigan michigan medicine
Domain: med.umich.edu

Name: University of Michigan/Michigan Medicine
norm: university of michigan michigan medicine
Domain: med.umich.edu
Industry: Healthcarellm

Discovered: May 23, 2024
Breach occurred: May 23, 2024 – May 29, 2024
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Identity (basic)Health (basic)PHI
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Regulator citations: Reported this incident to law enforcementNotifying the U.S. Department of Health and Human Services Office for Civil Rights
Initial access: phishing_link

During the incident: Attacker's IP address was blocked
Immediate password changes were made
Engaged a vendor to assist in the mailing of patient notice letters
Reported this incident to law enforcement
Notifying the U.S. Department of Health and Human Services Office for Civil Rights
Changes made: Strengthened existing processes for verifying caller identity and resetting passwords through our internal service desk
All Michigan Medicine staff will also receive additional education on how social engineering attacks work, the need to select strong passwords, and the need to use different passwords for multiple sites
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 10 weeks(69 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

HHS OCRJul 19 · first

Montana State AG+12d · this page

Pattern: first filing Jul 19 (MI), last Jul 31 (MT) — a 12-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-Notification-Letter-842.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 31, 2024
Raw hash: eeac84f6785df0b9c52453c1c516a4a979590a0bd3b86c15a6e3e193ef914d81

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityUniversity of Michigan/Michigan Medicine

Victim entityUniversity of Michigan/Michigan Medicine

Incidentdiscovered May 23, 2024

Stated responseAttacker's IP address was blocked

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov