HackingHealthcareHealthcareVulnerability ExploitSupply Chain (3P Vendor)Customer Data InvolvedDelayed DiscoveryPHIIdentity (basic)Health (basic)LowContained

Sutter Buttes Imaging Medical Group, Inc.

bd_994b92bf72ea98e8 · schema v1 · pii pii-v1

Severity

Low

Discovered

Dec 1, 2020

Filed

Feb 9, 2021

To disclose

10 weeks

Affected

Not disclosed

Confidence

65%

Full breach record for Sutter Buttes Imaging Medical Group, Inc. →

Sutter Buttes Imaging Medical Group, Inc. disclosed that third-party IT hardware vulnerabilities allowed unauthorized access to patient information between July 2019 and December 2020. The organization learned of the incident in December 2020. Affected data included patient names, dates of birth, study dates, and procedure types, but excluded SSNs, credit cards, and medical diagnoses. The company closed firewall ports and engaged third-party consultants to bolster security.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 519 days

discovery → filing · 10 weeks / 70 days

Jul 1, 2019

Begins

Dec 1, 2020

Discovered

Feb 9, 2021

Filed

vs. sector median

1 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: Sutter Buttes Imaging Medical Group, Inc.
norm: sutter buttes imaging medical

Name: Sutter Buttes Imaging Medical Group, Inc.
norm: sutter buttes imaging medical
Industry: Healthcarellm

Discovered: Dec 1, 2020
Breach occurred: Jul 1, 2019 – Dec 7, 2020
Undetected for: 519 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: PHIIdentity (basic)Health (basic)
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Initial access: supply_chain

During the incident: Conducted a thorough investigation
Closed certain firewall ports to prevent future access
Engaged third party IT consultants to perform a thorough analysis and bolster our security controls going forward
Changes made: Closed certain firewall ports to prevent future access
Engaged third party IT consultants to perform a thorough analysis and bolster our security controls going forward
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 10 weeks(70 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-537879
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 9, 2021
Raw hash: b0c1f3d827aac3bef276f9b21f17eeeb3e66a8728daea9b044450417d3967fcc

Reporting entitySutter Buttes Imaging Medical Group, Inc.

Victim entitySutter Buttes Imaging Medical Group, Inc.

Incidentdiscovered Dec 1, 2020

Stated responseConducted a thorough investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov