AccidentalHealthcareHealthcareMisconfigurationCustomer Data InvolvedSupply Chain (3P Vendor)PHIIdentity (basic)Government IDHealth (basic)MediumResolved

Silver Creek Fitness & Physical Therapy

bd_9d64cee62dcdf72b · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 11, 2016

Filed

Oct 24, 2016

To disclose

6 weeks

Affected

Not disclosed

Linked

2 filings

Confidence

64%

Full breach record for Silver Creek Fitness & Physical Therapy →

Silver Creek Fitness & Physical Therapy notified patients of a data breach involving protected health information. A third-party billing and software vendor's Amazon S3 storage account was misconfigured, making it publicly accessible from May 1, 2016, to September 11, 2016. A security researcher accessed and downloaded data, including names, SSNs, Medicare numbers, and treatment notes, before the vulnerability was discovered and secured on September 11, 2016. The researcher deleted the data. The company offered credit monitoring via Equifax.

J jump to incidentP pin to compareR raw source

California clockDiscovered Sep 11, 2016 → Notified Oct 19, 201638d ✓ CA 60-day OK6 weeks discovery → filing

Incident timeline

undetected · 133 days

discovery → filing · 6 weeks / 43 days

May 1, 2016

Begins

Sep 11, 2016

Discovered

Oct 24, 2016

Filed

vs. sector median

5 wks faster

This filing is one of 2 about the same incident.View merged incident

Part of Rehab Billing Solutions supply-chain incident (2016) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

HHS OCRbd_525466bffcf1c3192016-10-24Verified

Name: Silver Creek Fitness & Physical Therapy
norm: silver creek fitness physical therapy

Name: Silver Creek Fitness & Physical Therapy
norm: silver creek fitness physical therapy
Industry: Healthcarellm

Discovered: Sep 11, 2016
Breach occurred: May 1, 2016 – Sep 11, 2016
Undetected for: 133 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 19, 2016
Affected individuals: Not disclosed
Data types: PHIIdentity (basic)Government IDHealth (basic)
Attack vector: Misconfiguration
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Regulator citations: Providing notice of this incident to certain state regulatorsProviding notice of this incident to the Department of Health and Human Services
Third party: via Billing and software companies
Initial access: external_remote_services

During the incident: Took steps to secure the storage account
Launched an investigation to determine whether any sensitive information was accessed or acquired
Providing notice of this incident to all potentially impacted individuals
Arranged with Equifax Personal Solutions to help you protect your identity and your credit information at no cost to you
Providing notice of this incident to certain state regulators, consumer reporting agencies and the Department of Health and Human Services
Changes made: Ensured that access to the storage account is restricted
Ensured that proper access credentials are in place
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(43 days from discovery to filing)
Compliance flags: CA 60-day OK · 38d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Sep 11, 2016
→ Notified: Oct 19, 2016
38d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Sep 11, 2016 → Notified: Oct 19, 2016	38d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings

View merged incident ↗

HHS OCROct 24 · first

California State AGOct 24 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-64521
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 24, 2016
Raw hash: 2357b86ce1e9a4786cf6c79b0cf32af127511257079a560612017259fff8286a

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entitySilver Creek Fitness & Physical Therapy

Victim entitySilver Creek Fitness & Physical Therapy

Incidentdiscovered Sep 11, 2016

Stated responseTook steps to secure the storage account

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov