HackingHealthcareHealthcareCustomer Data InvolvedDelayed DiscoveryPHIIdentity (basic)Government IDHealth (basic)MediumContained

Hunt Regional Medical Center

bd_b6b3b34268da3d9c · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 14, 2019

Filed

Oct 9, 2019

To disclose

21 weeks

Affected

Not disclosed

Linked

2 filings

Confidence

65%

Hunt Regional Medical Center notified patients of a cyber attack where hackers gained access to patient medical records containing names, SSNs, and health data. The attack occurred starting in May 2018, but the organization first became aware of the compromise on May 14, 2019. The incident was contained, and the FBI is investigating. Identity protection services were offered to affected individuals.

J jump to incidentP pin to compareR raw source

California clockDiscovered May 14, 2019 → Notified Oct 7, 2019146d ✗ CA 60-day late21 weeks discovery → filing

Incident timeline

undetected · 378 days

discovery → filing · 21 weeks / 148 days

May 1, 2018

Begins

May 14, 2019

Discovered

Oct 9, 2019

Filed

vs. sector median

+9 wks slower

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Montana State AGbd_e6c67f6645f617432019-10-07 · +2dCandidate

Name: Hunt Regional Medical Center
norm: hunt regional medical center

Name: Hunt Regional Medical Center
norm: hunt regional medical center
Industry: Healthcarellm

Discovered: May 14, 2019
Breach occurred: May 1, 2018 – May 14, 2019
Undetected for: 378 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 7, 2019
Affected individuals: Not disclosed
Data types: PHIIdentity (basic)Government IDHealth (basic)
Data elements: Date of birthMedical information
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Cooperating with the FBI in its investigation of this incident

During the incident: Cooperating with the FBI in its investigation of this incident
Retained the services of cyber security professionals to further investigate the incident
Reinforced security protocols
Increased employee training
Enhanced threat detection and monitoring capabilities
Implementing additional safeguards to strengthen data security within our computer environment
Offering identity protection services through ID Experts
Changes made: Reinforced security protocols
Increased employee training
Enhanced threat detection and monitoring capabilities
Implementing additional safeguards to strengthen data security within our computer environment
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 21 weeks(148 days from discovery to filing)
Compliance flags: CA 60-day late · 146d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: May 14, 2019
→ Notified: Oct 7, 2019
146d 60 days (analyst band, pre-2026 discoveries) CA 60-day late

Statute	Window	Elapsed	Threshold	Status
California	Discovered: May 14, 2019 → Notified: Oct 7, 2019	146d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Montana State AGOct 7 · first

California State AG+2d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-183273
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 9, 2019
Raw hash: 6092b2e78b2d67af7a7d94aa2c7f6975528e8fdb2a8be47e76be7f296878c4e8

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityHunt Regional Medical Center

Victim entityHunt Regional Medical Center

Incidentdiscovered May 14, 2019

Stated responseCooperating with the FBI in its investigation of this incident

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov