MalwareHealthcareTechnologyHealthcareRansomwareData ExfiltratedData EncryptedCustomer Data InvolvedEmployee Data InvolvedEmploymentHealth (basic)Identity (basic)Government IDPHIMediumContained

Fallon Ambulance Services

bd_b235a9826165cd88 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 21, 2023

Filed

Dec 29, 2023

To disclose

36 weeks

Affected

940state residents only

Linked

7 filings

Confidence

69%

Full breach record for Fallon Ambulance Services →3 incidents on file

Fallon Ambulance Services, a subsidiary of Transformative Healthcare, reported a ransomware incident affecting archived data of approximately 940 Washington residents. Unauthorized access occurred between Feb 17 and Apr 22, 2023, detected on Apr 21, 2023. Impacted data included names, SSNs, medical info, and employment data. Fallon engaged third-party specialists and federal law enforcement, and offered two years of identity protection services.

J jump to incidentP pin to compareR raw source

Washington clock✗ WA AG >90d36 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 63 days

discovery → filing · 36 weeks / 252 days

Feb 17, 2023

Begins

Apr 21, 2023

Discovered

Dec 29, 2023

Filed

vs. sector median

+25 wks slower

This filing is one of 7 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

California State AGbd_d00356114bbdcd1e2023-12-29Candidate
South Carolina State AGbd_f27b5c3daffe31ba2023-12-29Verified
New Hampshire State AGbd_80bc1b119564c2f62023-12-28 · +1dVerified
HHS OCRbd_69bdd56750b2ff632023-12-31 · +2dCandidate

Show 2 more filings ↓up to 2d gap

Vermont State AGbd_2847eb9a18943e5a2023-12-27 · +2dVerified
Montana State AGbd_cc199dfe8cb04b132023-12-27 · +2dCandidate

Name: GOODWIN PROCTER LLP
norm: goodwin procter
Domain: goodwinlaw.com

Name: Fallon Ambulance Services
norm: fallon ambulance
Industry: HealthcarellmTechnologyllm

Discovered: Apr 21, 2023
Breach occurred: Feb 17, 2023 – Apr 22, 2023
Undetected for: 63 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 27, 2023
Affected individuals: 940state-resident count only
Data types: Identity (basic)Government IDHealth (basic)Employment
Data elements: NameSocial Security numberDriver's licence numberDate of birthHealth insurance IDMedical information
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 1-99dexposure 1-99d
WA-stated discovery: Found while ongoing
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified Attorney General Bob Ferguson pursuant to Wash. Rev. Code § 19.255.010Consulted with federal law enforcement

During the incident: Took steps to secure the archive
Initiated a comprehensive investigation into the matter with the assistance of third-party specialists
Conducted a comprehensive evaluation of the potentially impacted files
Offering two years of identity protection services, at no cost, to affected individuals through IDX
Consulted with federal law enforcement in support of its investigation and response to this matter
Changes made: Secured data that may be stored in its archives for compliance with its legal obligations
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 36 weeks(252 days from discovery to filing)
Compliance flags: WA AG >90d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 7 states

View merged incident ↗

Vermont State AGDec 27 · first

Montana State AGDec 27 · first

New Hampshire State AG+1d

California State AG+2d

South Carolina State AG+2d

Washington State AG+2d · this page

HHS OCR+4d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27447.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 29, 2023
Raw hash: 39d58d1153f03682abeab453ef7392b848836cbbeb35f2b23af3c6235c92439f

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityGOODWIN PROCTER LLP

Victim entityFallon Ambulance Services

Incidentdiscovered Apr 21, 2023

Stated responseTook steps to secure the archive

ComplianceWA AG >90d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com