Social EngineeringGovernmentHealthcareGovernmentPhishingMulti-Stage ChainCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDHealth (basic)PHIMediumResolved

City of Philadelphia

bd_9f21e8297af5cec7 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 31, 2020

Filed

Apr 14, 2021

To disclose

13 months

Affected

1state residents only

Linked

2 filings

Confidence

64%

Full breach record for City of Philadelphia →9 incidents on file

City of Philadelphia DBHIDS and business associate CBH notified individuals of a phishing attack impacting employee email accounts. Unauthorized access occurred March 11–Nov 16, 2020. Affected data included names, SSNs, DOBs, medical record numbers, and PHI. City reset passwords, enhanced security, and offered 12 months of identity monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 20 days

discovery → filing · 13 months / 379 days

Mar 11, 2020

Begins

Mar 31, 2020

Discovered

Apr 14, 2021

Filed

vs. sector median

+43 wks slower

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Maine State AGbd_fd232d7509ce9f112021-06-11 · +58dVerified

Name: City of Philadelphia
norm: city of philadelphia

Name: City of Philadelphia
norm: city of philadelphia
Industry: GovernmentllmHealthcarellm

Discovered: Mar 31, 2020
Breach occurred: Mar 11, 2020 – Nov 16, 2020
Undetected for: 20 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government IDHealth (basic)PHI
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1114 Email CollectionT1078 Valid Accounts
Threat actor: External
Initial access: phishing_link

During the incident: Resetting impacted employees’ email account passwords
Increasing monitoring of network activity
Implementing tools to enhance email security
Launched an internal investigation
Providing 12 months of complimentary access to identity monitoring services through Kroll
Changes made: Reviewing our existing policies and procedures to identify ways to better prevent similar incidents from occurring in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 13 months(379 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Montana State AGApr 14 · first · this page

Maine State AG+58d

Pattern: first filing Apr 14 (MT), last Jun 11 (ME) — a 58-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/Phila-notif.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 14, 2021
Raw hash: b7d27662f4af18281971265aa53994943a28bd5bf1b891a370291e2b20640074

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityCity of Philadelphia

Victim entityCity of Philadelphia

Incidentdiscovered Mar 31, 2020

Stated responseResetting impacted employees’ email account passwords

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov