AccidentalHealthcareEducationHealthcareMisconfigurationDelayed DiscoveryIdentity (basic)Government IDMediumContained

Virginia Commonwealth University Health System Authority

bd_a10e64988358535b · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 29, 2020

Filed

Apr 9, 2020

To disclose

6 weeks

Affected

1state residents only

Confidence

66%

Full breach record for Virginia Commonwealth University Health System Authority →6 incidents on file

Virginia Commonwealth University Health System (VCUHS) notified the NH AG of a programmatic error in its intranet Healthcare Provider Database. From 2008 to March 2, 2020, a resident's Social Security number was visible in a field labeled 'Resident Primer License.' Discovered Feb 29, 2020, the error was corrected. One NH resident affected. No evidence of misuse. VCUHS offered credit monitoring and fraud alert guidance.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 4442 days

discovery → filing · 6 weeks / 40 days

Jan 1, 2008

Begins

Feb 29, 2020

Discovered

Apr 9, 2020

Filed

vs. sector median

3 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1 affectedView incident

Name: Virginia Commonwealth University Health System Authority
norm: virginia commonwealth university health system authority
Domain: vcuhealth.org

Name: Virginia Commonwealth University Health System Authority
norm: virginia commonwealth university health system authority
Domain: vcuhealth.org
Industry: HealthcarellmEducationllm

Discovered: Feb 29, 2020
Breach occurred: Jan 1, 2008 – Mar 2, 2020
Undetected for: 4,442 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 27, 2020
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Misconfiguration
Regulator citations: Notified New Hampshire Attorney General

During the incident: Promptly launched an investigation
Immediately corrected the programmatic error
Removed all Social Security numbers from the Provider Database
Working very closely with external cybersecurity professionals
Changes made: Offering a complimentary one-year membership with a credit monitoring service
Advising the affected resident about the process for placing fraud alerts and/or security freezes on his/her credit files and obtaining free credit reports
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(40 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/virginia-commonwealth-university-health-system-20200409.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 9, 2020
Raw hash: cef275be90a4309524506ef79cfb03874855bfaa0d915a86ea25e053080537a0

Reporting entityVirginia Commonwealth University Health System Authority

Victim entityVirginia Commonwealth University Health System Authority

Incidentdiscovered Feb 29, 2020

Stated responsePromptly launched an investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov