HackingHealthcareHealthcareCustomer Data InvolvedPIIIdentity (basic)Government IDHigh

Fred Hutchinson Cancer Center

bd_925ee43ceec80c67 · schema v1 · pii pii-v1

Severity

High

Discovered

Oct 27, 2023

Filed

Feb 29, 2024

To disclose

18 weeks

Affected

14,898state residents only

Linked

13 records

Confidence

71%

Full breach record for Fred Hutchinson Cancer Center →4 incidents on file

Fred Hutchinson Cancer Center reported a breach in Washington state involving the theft or mistake of patient records. The incident occurred on October 27, 2023, affecting 14,898 Washington residents. Data types include PII and government identifiers. No specific attack vector or malware family was identified in the filing.

J jump to incidentP pin to compareR raw source

Washington clock✗ WA AG >90d18 weeks discovery → filing

Incident timeline

discovery → filing · 18 weeks / 125 days

Oct 27, 2023

Begins

Oct 27, 2023

Discovered

Feb 29, 2024

Filed

vs. sector median

+9 wks slower

This filing is one of 13 records about the same incident.View merged incident

A leak claim by hunters_international about this victim was first seen 76 days before this filing.View originating leak claim

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

Montana State AGbd_939adbdc1316f7952024-02-29Verified by operator
HHS OCRbd_8814fc6d061ec55d2023-12-26 · +65dVerified by operator
Oregon State AGbd_00321461c9a219542023-12-22 · +69dVerified
California State AGbd_055977ba69ddd4322023-12-22 · +69dVerified by operator

Show 6 more filings ↓up to 154d gap

Montana State AGbd_390649f2c75439432023-12-22 · +69dVerified
Massachusetts State AGbd_632cb3e03653a6452023-12-22 · +69dVerified
HHS OCRbd_734a45a1ef5248522023-12-22 · +69dVerified
Washington State AGbd_b7c7ee56fd79dc242023-12-22 · +69dVerified by operator
Vermont State AGbd_12adcd78f9e863af2023-12-20 · +71dVerified by operator
Illinois State AGbd_e82634db0b6646752024-08-01 · +154dVerified by operator

Showing first 10 of 12 linked disclosures.

Name: Fred Hutchinson Cancer Center
norm: fred hutchinson cancer center
Domain: fredhutch.org

Name: Fred Hutchinson Cancer Center
norm: fred hutchinson cancer center
Domain: fredhutch.org
Industry: Healthcarellm

Discovered: Oct 27, 2023
Breach occurred: Oct 27, 2023
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 14,898state-resident count only
Data types: PIIIdentity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1052 Exfiltration Over Physical Medium
Threat actor: External

Time to disclose: 18 weeks(125 days from discovery to filing)
Compliance flags: WA AG >90dLeak >30d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 7 states

View merged incident ↗

Vermont State AGDec 20 · first

Oregon State AG+2d

California State AG+2d

Montana State AG+2d

Massachusetts State AG+2d

HHS OCR+2d

Washington State AG+2d

HHS OCR+6d

Montana State AG+71d

Washington State AG+71d · this page

Illinois State AG+225d

Pattern: first filing Dec 20 (VT), last Aug 1 (IL) — a 225-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Cascade drawn from the first 10 linked disclosures of 12 — the full spread may be wider.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA28127.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 29, 2024
Raw hash: 1798a19640af98d15d0722ab49b47d5849e8a282a5792e2c08efcd641b0233af

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entityFred Hutchinson Cancer Center

Victim entityFred Hutchinson Cancer Center

Incidentdiscovered Oct 27, 2023

ComplianceWA AG >90d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com