Social EngineeringHealthcareHealthcarePhishingStolen CredentialsCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDHealth (basic)PHIMediumContained

Saint Anthony Hospital

bd_9e32c68d3e02309d · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 6, 2025

Filed

Sep 12, 2025

To disclose

31 weeks

Affected

1state residents only

Linked

5 filings

Confidence

63%

Full breach record for Saint Anthony Hospital →3 incidents on file

Saint Anthony Hospital notified South Carolina residents of a cybersecurity incident discovered on February 6, 2025, involving unauthorized access to two employee email accounts. The incident potentially exposed PHI, SSNs, DOBs, and patient names. The hospital secured its network, reported to law enforcement, and engaged external cybersecurity professionals. Affected individuals are offered 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Leak gap clock✗ Leak >180d31 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

discovery → filing · 31 weeks / 218 days

Feb 6, 2025

Discovered

Sep 12, 2025

Filed

vs. sector median

+20 wks slower

This filing is one of 5 about the same incident.View merged incident

A leak claim by lockbit_3 about this victim predates this filing by 589 days.View originating leak claim

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

HHS OCRbd_bd345412deefdac22025-09-12Verified
Indiana State AGbd_ff580f0efc3c9a182025-09-12Verified
Illinois State AGbd_5fbf557105f8a1c22025-09-01 · +11dCandidate
Illinois State AGbd_9818f8c94d9260b82025-09-01 · +11dCandidate

Name: Saint Anthony Hospital
norm: saint anthony hospital
Domain: sahchicago.org

Name: Saint Anthony Hospital
norm: saint anthony hospital
Domain: sahchicago.org
Industry: Healthcarellm

Discovered: Feb 6, 2025
Materiality determined: —
Notification sent: Sep 12, 2025
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government IDHealth (basic)PHI
Data elements: Date of birthMedical information
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: External
Regulator citations: reported the incident to law enforcement
Initial access: phishing_link

During the incident: Secured our network
Reported the incident to law enforcement
Commenced a prompt and thorough investigation
Working very closely with external cybersecurity professionals
Conducted a thorough review of the potentially impacted data
Providing you with access to Single Bureau Credit Monitoring/Single Bureau Credit Report/Single Bureau Credit Score services at no charge
Providing you with proactive fraud assistance
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 31 weeks(218 days from discovery to filing)
Compliance flags: Leak >180d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 3 states

View merged incident ↗

Illinois State AGSep 1 · first

HHS OCR+11d

Indiana State AG+11d

South Carolina State AG+11d · this page

Pattern: first filing Sep 1 (IL), last Sep 12 (SC) — a 11-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/Consumer%20Letter%20SAH.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 12, 2025
Raw hash: b8f8363f1cf84bc7b05a72bd1f3354395293f2a6dd624abe912ba6f7ac46f946

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entitySaint Anthony Hospital

Victim entitySaint Anthony Hospital

Incidentdiscovered Feb 6, 2025

Stated responseSecured our network

ComplianceLeak >180d

Extraction provenanceno artifact recorded

Source provenanceconsumer.sc.gov