MalwareHealthcareHealthcareRansomwareData ExfiltratedData EncryptedRansom DemandedTargetedPIIIdentity (basic)Government IDPHIHealth (basic)Financial accountHighContained

University Medical Center of Southern Nevada

bd_b5a43b495ad8cbd7 · schema v1 · pii pii-v1

Severity

High

Discovered

Jun 14, 2021

Filed

Oct 4, 2021

To disclose

16 weeks

Affected

5,798state residents only

Linked

8 filings

Confidence

65%

Full breach record for University Medical Center of Southern Nevada →5 incidents on file

University Medical Center of Southern Nevada notified individuals of a ransomware incident occurring June 14-15, 2021. The attack compromised PII and PHI, including SSNs and clinical data. UMC engaged law enforcement (FBI/LVMPD) and forensic experts, and offered 12 months of identity protection via IDX.

J jump to incidentP pin to compareR raw source

Hawaii clock✓ HI CRA notice due16 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 16 weeks / 112 days

Jun 14, 2021

Begins

Jun 14, 2021

Discovered

Oct 4, 2021

Filed

vs. sector median

+5 wks slower

This filing is one of 8 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (7) · sorted by filing gap

New Hampshire State AGbd_d0c1f4f3c23b91252021-10-08 · +4dVerified
Washington State AGbd_756fa6a223b1263e2021-10-11 · +7dVerified
California State AGbd_8cd435f422ca0e842021-10-15 · +11dVerified
Oregon State AGbd_d23eb997abdde2de2021-10-20 · +16dVerified

Show 3 more filings ↓up to 63d gap

Maine State AGbd_bceb7eed3b6af9bd2021-10-26 · +22dVerified
HHS OCRbd_63cc22340e1652572021-08-13 · +52dVerified
Indiana State AGbd_eca87a0728f343752021-08-02 · +63dVerified

Name: University Medical Center of Southern Nevada
norm: university medical center of southern nevada

Name: University Medical Center of Southern Nevada
norm: university medical center of southern nevada
Industry: Healthcarellm

Discovered: Jun 14, 2021
Breach occurred: Jun 14, 2021 – Jun 15, 2021
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 2, 2021
Affected individuals: 5,798state-resident count only
Data types: PIIIdentity (basic)Government IDPHIHealth (basic)Financial account
Data elements: Date of birth
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified the FBINotified the Las Vegas Metropolitan Police Department

During the incident: Restricted external access to UMC servers
Notified the FBI and the Las Vegas Metropolitan Police Department
Engaged external cyber security professionals
Updating internal and external technology solutions
Partnered with IDX to offer complimentary identity protection services
Changes made: Updating internal and external technology solutions
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 16 weeks(112 days from discovery to filing)
Compliance flags: HI CRA notice due
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 8 states

View merged incident ↗

Indiana State AGAug 2 · first

HHS OCR+11d

Hawaii State AG+63d · this page

New Hampshire State AG+67d

Washington State AG+70d

California State AG+74d

Oregon State AG+79d

Maine State AG+85d

Pattern: first filing Aug 2 (IN), last Oct 26 (ME) — a 85-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://web.archive.org/web/20211127200109id_/https://cca.hawaii.gov/ocp/files/2021/10/OCP-2021-0798.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 4, 2021
Raw hash: 54a6aa45ea280a5d2856ba9efd82612c331aaeb8aeb6abad40cdfc70064edbb4

Linked disclosures

Regulatory filings (7) · sorted by filing gap

Reporting entityUniversity Medical Center of Southern Nevada

Victim entityUniversity Medical Center of Southern Nevada

Incidentdiscovered Jun 14, 2021

Stated responseRestricted external access to UMC servers

ComplianceHI CRA notice due

Extraction provenanceno artifact recorded

Source provenanceweb.archive.org