HackingHealthcareHealthcareStolen CredentialsCustomer Data InvolvedTargetedIdentity (basic)Health (basic)LowContained

Phoenix Children's Hospital, Inc.

bd_9894b970c338456e · schema v1 · pii pii-v1

Severity

Low

Discovered

Nov 15, 2019

Filed

Jan 14, 2020

To disclose

9 weeks

Affected

1state residents only

Linked

5 filings

Confidence

66%

Full breach record for Phoenix Children's Hospital, Inc. →2 incidents on file

Phoenix Children's Hospital notified NH AG of a cyber attack where an unauthorized third party accessed seven employee email accounts between Sept 5-20, 2019. The incident impacted one NH resident, exposing their name and limited health information. The hospital secured accounts and engaged forensic investigators.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 71 days

discovery → filing · 9 weeks / 60 days

Sep 5, 2019

Begins

Nov 15, 2019

Discovered

Jan 14, 2020

Filed

vs. sector median

on median

This filing is one of 5 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

HHS OCRbd_594cc2b512b3e88c2020-01-14Verified
Indiana State AGbd_054a8aedc022fbda2020-01-15 · +1dVerified
Illinois State AGbd_3dd6b028425b9aec2020-01-01 · +13dVerified
Illinois State AGbd_f62c1bff85427b7f2020-01-01 · +13dVerified

Name: Phoenix Children's Hospital, Inc.
norm: phoenix children s hospital
Domain: phoenixchildrens.org

Name: Phoenix Children's Hospital, Inc.
norm: phoenix children s hospital
Domain: phoenixchildrens.org
Industry: Healthcarellm

Discovered: Nov 15, 2019
Breach occurred: Sep 5, 2019 – Sep 20, 2019
Undetected for: 71 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 14, 2020
Affected individuals: 1state-resident count only
Data types: Identity (basic)Health (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: External
Initial access: valid_credentials

During the incident: Secured the email account credentials
Retained a leading forensic security firm to investigate and confirm the overall security of its email and computer systems
Conducted a comprehensive search for any personal information in the impacted email accounts
Changes made: Reviewing our technical controls
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(60 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 4 states

View merged incident ↗

Illinois State AGJan 1 · first

HHS OCR+13d

New Hampshire State AG+13d · this page

Indiana State AG+14d

Pattern: first filing Jan 1 (IL), last Jan 15 (IN) — a 14-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/phoenix-childrens-hospital-20200114.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 14, 2020
Raw hash: 0c302bfb289efe6ed17110cca7d25d7fca9c7ddad3fa9720710d5ee6008d5f73

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityPhoenix Children's Hospital, Inc.

Victim entityPhoenix Children's Hospital, Inc.

Incidentdiscovered Nov 15, 2019

Stated responseSecured the email account credentials

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov