MalwareHealthcareHealthcareRansomwareSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDMediumContained

Rainier Clinical Research Center

bd_a086227fa2f255c8 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 18, 2026

Filed

Apr 3, 2026

To disclose

11 weeks

Affected

650state residents only

Linked

2 records

Confidence

69%

Full breach record for Rainier Clinical Research Center →

Rainier Clinical Research Center, a healthcare research facility in Renton, WA, notified the WA AG of a ransomware incident affecting its IT managed service provider. Unauthorized access occurred Jan 15-18, 2026. PII (names, SSNs, driver's licenses) of 650 WA residents was compromised. Notification sent April 6, 2026, with credit monitoring offered.

J jump to incidentP pin to compareR raw source

Washington clock⏱ WA AG >30d11 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 3 days

discovery → filing · 11 weeks / 75 days

Jan 15, 2026

Begins

Jan 18, 2026

Discovered

Apr 3, 2026

Filed

vs. sector median

+2 wks slower

This filing is one of 2 records about the same incident.View merged incident

A leak claim by inc_ransom about this victim was first seen 39 days before this filing.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Siteinc_ransombd_1a9b831ee5ef93972026-02-23 · +39dCandidate

Name: Kennedys Law LLP
norm: kennedys law
Domain: rainier-research.com

Name: Rainier Clinical Research Center
norm: rainier clinical research center
Domain: rainier-research.com
Industry: Healthcarellm

Discovered: Jan 18, 2026
Breach occurred: Jan 15, 2026 – Jan 18, 2026
Undetected for: 3 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 6, 2026
Affected individuals: 650state-resident count only
Data types: Identity (basic)Government ID
Data elements: NameSocial Security numberDriver's licence number
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 1-99dexposure 1-99d
WA-stated discovery: Found while ongoingContained same day
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain CompromiseT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified Washington Office of Attorney GeneralNotification will also be made concurrently to the Montana Office of Attorney General
Third party: via IT managed service provider
Initial access: supply_chain

During the incident: Launched an investigation to address the incident and terminate further unauthorized access
Engaged the cyber security forensics firm CFC Security, Inc. d/b/a/ CFC Response
Notified federal law enforcement
Notified these individuals via First Class U.S. mail
Offering 12 months of single bureau credit monitoring, fraud consultation, and identity theft restoration services through Kroll
Set up a professional call center to respond to individuals’ inquiries
Changes made: Reviewing its existing security policies and protections previously in place on its network
Adopting additional security to safeguard against evolving threats moving forward
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 11 weeks(75 days from discovery to filing)
Compliance flags: WA AG >30dLeak >30d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA37589.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 3, 2026
Raw hash: 2e3dd2816db6a2ad37e95396fddf9e265d684972008c92741ba15982a9ec7806

Linked disclosures

Ransomware claims (1)

Reporting entityKennedys Law LLP

Victim entityRainier Clinical Research Center

Incidentdiscovered Jan 18, 2026

Stated responseLaunched an investigation to address the incident and terminate further unauthorized access

ComplianceWA AG >30d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com