VASocial EngineeringHealthcareHealthcarePhishingPHICREDENTIALSMediumResolved

Region Ten Community Services Board

bd_9be0718ba5cd05cd · schema v1 · pii pii-v1

Full breach record for Region Ten Community Services Board →

Region Ten Community Services Board (VA, healthcare provider) reported a credential-phishing incident in which multiple employees responded to an email impersonating an internal sender that warned of mailbox-quota issues and prompted them to enter username and password at a linked site. A forensic investigation did not identify confirmed compromise of sensitive client information, but as a precaution the CE notified 10,228 individuals, issued a press release, and posted notice on its website. The CE engaged a technology consulting firm and provided OCR written assurance of network updates including an additional firewall. OCR breach portal entry filed 2013-09-26; no business associate involved.

HIPAA clock✓ HHS notified

⚠ no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.

⚠ No discovery dateThe OCR public portal omits the discovery date, so the 60-day notification clock cannot be evaluated from this source — only that the filing was submitted.

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed10,228 affectedView incident

Source provenance

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Sep 26, 2013
Raw hash: a07a9a226100bdf75c737e103ec771e43daa0b166e9243859d128a3180454183

Source filing

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html1.7 KB

Download View at source

Reporting entity

Name: Region Ten Community Services Board
norm: region ten community services board
Industry: Healthcare Provider

Victim entity

Name: Region Ten Community Services Board
norm: region ten community services board
Industry: Healthcare Provider
Industry: Healthcaresource default

Incident

Discovered: Not extracted — the OCR public portal omits it
Materiality determined: —
Notification sent: —
Affected individuals: 10,228
Data types: PHICREDENTIALS
Attack vector: Phishing
Threat actor: External
Regulator citations: OCR breach report submitted 2013-09-26Provided written assurance to OCR regarding remediation

Compliance

Compliance flags: HHS notified
Discovery-date grounding: no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: not extracted
→ Notified: not extracted
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: not extracted → Notified: not extracted	—	regulatory submission	HHS notified

Extraction provenance

Status: No extraction artifact recorded for this disclosure.