AccidentalHealthcareHealthcareDisposal ErrorCustomer Data InvolvedIdentity (basic)Government IDFinancial accountMediumContained

HealthReach Community Health Centers

bd_a26ee07e1b1e11b2 · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 7, 2021

Filed

Sep 7, 2021

To disclose

18 weeks

Affected

31state residents only

Linked

3 filings

Confidence

66%

Full breach record for HealthReach Community Health Centers →2 incidents on file

HealthReach Community Health Centers notified Montana residents of a data incident on September 7, 2021. On May 7, 2021, the organization learned that hard drives containing employee and customer PII (names, SSNs, DOBs, financial accounts) were improperly disposed of by a third-party vendor. No evidence of misuse was found. The company engaged counsel, monitored the situation, and provided 24 months of identity theft protection services.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 18 weeks / 123 days

May 7, 2021

Begins

May 7, 2021

Discovered

Sep 7, 2021

Filed

vs. sector median

+5 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Maine State AGbd_4b97ea1bb4f0653f2021-09-09 · +2dVerified
Indiana State AGbd_bfe67f6eabd2fd112021-09-09 · +2dVerified

Name: HealthReach Community Health Centers
norm: healthreach community health centers
Domain: healthreach.org

Name: HealthReach Community Health Centers
norm: healthreach community health centers
Domain: healthreach.org
Industry: Healthcarellm

Discovered: May 7, 2021
Breach occurred: May 7, 2021
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 7, 2021
Affected individuals: 31state-resident count only
Data types: Identity (basic)Government IDFinancial account
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1052 Exfiltration Over Physical Medium
Threat actor: Partner

During the incident: Working with cybersecurity counsel to determine the actions to take in response to the incident
Investigating and closely monitoring the situation
Ensuring data storage vendors re-train employees and comply with required safeguards
Arranged for complimentary identity theft protection services through IDX
Changes made: Ensuring data storage vendors re-train employees
Ensuring data storage vendors comply with required safeguards as to the disposal of sensitive information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 18 weeks(123 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Montana State AGSep 7 · first · this page

Maine State AG+2d

Indiana State AG+2d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/consumer-notification-letter-14.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 7, 2021
Raw hash: 17eddbfdc3abb229ac437d19e68aa423f747871a74803b846a753bdf94b76d8a

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityHealthReach Community Health Centers

Victim entityHealthReach Community Health Centers

Incidentdiscovered May 7, 2021

Stated responseWorking with cybersecurity counsel to determine the actions to take in response to the incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov