HackingHealthcareHealthcareStolen CredentialsSupply Chain (3P Vendor)Data ExfiltratedIdentity (basic)Government IDPHIHealth (basic)MediumContained

Community Health Plan of Washington

bd_8eedda41b0dc7189 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 7, 2016

Filed

Dec 29, 2016

To disclose

7 weeks

Affected

18state residents only

Linked

6 filings

Confidence

66%

Full breach record for Community Health Plan of Washington →

Community Health Plan of Washington (CHPW) disclosed a data breach affecting member records stored by a third-party technology services provider. Unauthorized access occurred on January 16, 2016, and was discovered on November 7, 2016. Affected data included names, addresses, DOBs, SSNs, and healthcare claims coding. CHPW engaged forensic investigators, notified the FBI and state regulators, and offered 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 296 days

discovery → filing · 7 weeks / 52 days

Jan 16, 2016

Begins

Nov 7, 2016

Discovered

Dec 29, 2016

Filed

vs. sector median

5 wks faster

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Massachusetts State AGbd_d2a27a544a1af8442016-12-25 · +4dVerified
New Hampshire State AGbd_73ea96eb0f43c5892017-01-03 · +5dVerified
HHS OCRbd_e74e7ea642691fa12017-01-03 · +5dVerified
Washington State AGbd_0a35fce30888272b2016-12-21 · +8dCandidate

Show 1 more filing ↓up to 8d gap

HHS OCRbd_b14071585111bf302016-12-21 · +8dVerified

Name: Community Health Plan of Washington
norm: community health plan of washington

Name: Community Health Plan of Washington
norm: community health plan of washington
Industry: Healthcarellm

Discovered: Nov 7, 2016
Breach occurred: Jan 16, 2016
Undetected for: 296 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 18state-resident count only
Data types: Identity (basic)Government IDPHIHealth (basic)
Data elements: Social Security numberDate of birth
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: External
Regulator citations: Notified the Washington State Health Care AuthorityNotified the Washington State Office of the Insurance CommissionerReported the matter to the Federal Bureau of Investigation (FBI)
Initial access: valid_credentials

During the incident: Took immediate measures to disable access to the server
Launched an investigation
Engaged a digital forensics firm
Notified the Washington State Health Care Authority
Notified the Washington State Office of the Insurance Commissioner
Reported the matter to the Federal Bureau of Investigation (FBI)
Offering credit and identity monitoring services for 12 months at no cost
Changes made: Working with technology services provider to increase the security of all CHPW member information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 weeks(52 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 4 states

View merged incident ↗

Washington State AGDec 21 · first

HHS OCRDec 21 · first

Massachusetts State AG+4d

Montana State AG+8d · this page

New Hampshire State AG+13d

HHS OCR+13d

Pattern: first filing Dec 21 (WA), last Jan 3 (WA) — a 13-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/Community-Health-Plan-of-Washington.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 29, 2016
Raw hash: 21814b7ba74aeb57b6ea6e02d10a2f07d2bd60ce29ab1d10eef5cca837fde962

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityCommunity Health Plan of Washington

Victim entityCommunity Health Plan of Washington

Incidentdiscovered Nov 7, 2016

Stated responseTook immediate measures to disable access to the server

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov