Social EngineeringHealthcareHealthcarePhishingCustomer Data InvolvedPIIHealth (basic)Identity (basic)LowContained

THE UNIVERSITY OF CHICAGO MEDICAL CENTER

bd_9e22c09f8a6a0244 · schema v1 · pii pii-v1

Severity

Low

Discovered

Mar 24, 2022

Filed

May 27, 2022

To disclose

9 weeks

Affected

1state residents only

Linked

4 filings

Confidence

64%

Full breach record for THE UNIVERSITY OF CHICAGO MEDICAL CENTER →3 incidents on file

University of Chicago Medical Center notified Montana AG of an email security incident (March 24-31, 2022) where unauthorized access to employee accounts exposed patient names and health information (diagnoses, prescriptions). The company terminated access, engaged cybersecurity providers, and enhanced authentication and monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 9 weeks / 64 days

Mar 24, 2022

Begins

Mar 24, 2022

Discovered

May 27, 2022

Filed

vs. sector median

on median

This filing is one of 4 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Indiana State AGbd_0690d0e05a552af22022-05-27Verified
HHS OCRbd_6e06ddce4ffdca8c2022-05-27Verified
Maine State AGbd_cb7140429490406e2022-05-27Verified

Name: THE UNIVERSITY OF CHICAGO MEDICAL CENTER
norm: the university of chicago medical center
Domain: uchicagomedicine.org

Name: THE UNIVERSITY OF CHICAGO MEDICAL CENTER
norm: the university of chicago medical center
Domain: uchicagomedicine.org
Industry: Healthcarellm

Discovered: Mar 24, 2022
Breach occurred: Mar 24, 2022 – Mar 31, 2022
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 1state-resident count only
Data types: PIIHealth (basic)Identity (basic)
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid Accounts
Threat actor: External
Initial access: phishing_link

During the incident: Took steps to terminate the unauthorized access
Secure the affected email accounts
Began an investigation into the incident with assistance from a leading cybersecurity provider
Performed an analysis of the impacted email accounts
Changes made: Implemented additional security measures
Enhanced our user authentication controls
Enhanced our threat monitoring and detection processes
Providing ongoing training to our employees on the importance of email security
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(64 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Indiana State AGMay 27 · first

HHS OCRMay 27 · first

Maine State AGMay 27 · first

Montana State AGMay 27 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-Notification-63.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 27, 2022
Raw hash: ec707f6ae0e29d80161c38479936e6e0815c4de8fb455b18550fd654d3040e77

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityTHE UNIVERSITY OF CHICAGO MEDICAL CENTER

Victim entityTHE UNIVERSITY OF CHICAGO MEDICAL CENTER

Incidentdiscovered Mar 24, 2022

Stated responseTook steps to terminate the unauthorized access

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov