HackingHealthcareTechnologyHealthcareCustomer Data InvolvedBusiness Associate (HIPAA)Delayed DiscoveryPIIPHIIdentity (basic)MinorMediumContained

FastHealth Corporation

bd_99d8cf94ee6bff7f · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Feb 27, 2018

To disclose

—

Affected

Not disclosed

Linked

8 filings

Confidence

78%

Full breach record for FastHealth Corporation →3 incidents on file

FastHealth Corporation, a contracted healthcare IT vendor providing operational and website services to hospital clients, suffered unauthorized access to its web server in mid-August 2017. The breach was reported by law enforcement on November 2, 2017. A forensic investigation confirmed an unauthorized third party may have acquired data from certain databases. Data review was completed January 26, 2018. Affected parties included minors. Kroll identity monitoring was offered. The company implemented new encryption and strengthened security protocols.

J jump to incidentP pin to compareR raw source

Incident timeline

Aug 14, 2017

Begins

Feb 27, 2018

Filed

This filing is one of 8 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (7) · sorted by filing gap

HHS OCRbd_2dcab2d038f89ca32018-02-27Verified
Montana State AGbd_443fc3fc90bc52bd2018-02-27Verified
Washington State AGbd_54159cba1053fb1d2018-02-27Verified
Oregon State AGbd_60a50c8ffb21c5992018-02-27Verified

Show 3 more filings ↓up to 1d gap

New Hampshire State AGbd_6e7ede791280c1f22018-02-27Verified
Massachusetts State AGbd_ac89b2048db691782018-02-27Verified
South Carolina State AGbd_f7edfc4e5c60b1d52018-02-28 · +1dVerified

Name: FastHealth Corporation
norm: fasthealth
Domain: fasthealthcorporation.com

Name: FastHealth Corporation
norm: fasthealth
Domain: fasthealthcorporation.com
Industry: HealthcarellmTechnologyllm

Discovered: —
Breach occurred: Aug 14, 2017 – Aug 18, 2017
Materiality determined: —
Notification sent: Feb 1, 2018
Affected individuals: Not disclosed
Data types: PIIPHIIdentity (basic)Minor
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1530 Data from Cloud Storage Object
Threat actor: External
Initial access: exploit_public_facing

During the incident: Received a report from law enforcement on November 2, 2017 indicating that an unauthorized third party may have accessed or acquired certain information from FastHealth databases
Immediately began an investigation and hired a leading computer security firm to assist with the investigation
Secured the services of Kroll to provide identity monitoring at no cost to affected individuals for one year
Undertook a comprehensive review of the information in the databases involved, completed on January 26, 2018
Changes made: Implementing a new encryption solution for sensitive personal information that we store and maintain
Strengthening our data protection and security protocols
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 8 states

View merged incident ↗

HHS OCRFeb 27 · first

Montana State AGFeb 27 · first

Washington State AGFeb 27 · first

Oregon State AGFeb 27 · first

New Hampshire State AGFeb 27 · first

Massachusetts State AGFeb 27 · first

California State AGFeb 27 · first · this page

South Carolina State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-134095
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 27, 2018
Raw hash: 67e46dfb0769eb6d8f53078e31d794ab0b9365a4a55b1f6c5a2bc23b8406d141

Linked disclosures

Regulatory filings (7) · sorted by filing gap

Reporting entityFastHealth Corporation

Victim entityFastHealth Corporation

IncidentUnauthorized Access

Stated responseReceived a report from law enforcement on November 2, 2017 indicating that an unauthorized third party may have accessed or acquired certain information from FastHealth databases

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov