Social EngineeringHealthcareHealthcarePhishingData ExfiltratedCustomer Data InvolvedIdentity (basic)Health (basic)PHILowContained

CareATC, Inc.

bd_a3b3b4582032788c · schema v1 · pii pii-v1

Severity

Low

Discovered

Jun 29, 2021

Filed

Aug 27, 2021

To disclose

8 weeks

Affected

600state residents only

Linked

4 filings

Confidence

68%

Full breach record for CareATC, Inc. →

CareATC, Inc. notified Washington residents of a data breach involving unauthorized access to two employee email accounts. The incident occurred between June 18 and June 29, 2021, and was discovered on June 29, 2021. Approximately 600 Washington residents were affected, with their names, dates of birth, health insurance information, and medical diagnosis/treatment data potentially exposed. CareATC engaged forensic specialists, provided one year of credit monitoring through Kroll, and implemented additional employee training.

J jump to incidentP pin to compareR raw source

Washington clock⏱ WA AG >30d8 weeks discovery → filing

Incident timeline

undetected · 11 days

discovery → filing · 8 weeks / 59 days

Jun 18, 2021

Begins

Jun 29, 2021

Discovered

Aug 27, 2021

Filed

vs. sector median

4 wks faster

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Indiana State AGbd_05deb01b9d7467402021-08-27Verified
HHS OCRbd_77e80a9a5962cdb02021-08-27Verified
Montana State AGbd_f754571e55a72bc92021-08-27Verified

Name: CareATC, Inc.
norm: careatc

Name: CareATC, Inc.
norm: careatc
Industry: Healthcarellm

Discovered: Jun 29, 2021
Breach occurred: Jun 18, 2021 – Jun 29, 2021
Undetected for: 11 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 27, 2021
Affected individuals: 600state-resident count only
Data types: Identity (basic)Health (basic)PHI
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing Link
Threat actor: External
Regulator citations: notifying regulators as required
Initial access: phishing_link

During the incident: Initiated an investigation
Conducted by third party forensic specialists
Comprehensive review of the contents of the affected accounts
Moved quickly to investigate, assess the security of its systems, and notify potentially affected individuals
Working to implement additional safeguards and training to its employees
Providing individuals who had a Social Security number potentially affected by this incident with access to credit monitoring services for 1 year through Kroll at no cost
Providing impacted individuals with guidance on how to better protect against identity theft and fraud
Notifying regulators as required
Changes made: Implement additional safeguards and training to its employees
Conducted additional employee training related to email security
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(59 days from discovery to filing)
Compliance flags: WA AG >30d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Indiana State AGAug 27 · first

HHS OCRAug 27 · first

Montana State AGAug 27 · first

Washington State AGAug 27 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA1098.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 27, 2021
Raw hash: 87b68f76f378f0cdd81c628e2ff7c589ed5bca5f3ef42820be1d2db8497dbdc4

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityCareATC, Inc.

Victim entityCareATC, Inc.

Incidentdiscovered Jun 29, 2021

Stated responseInitiated an investigation

ComplianceWA AG >30d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com