HackingHealthcareHealthcareSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)Health (basic)Government IDMediumContained

Atrium Health (formerly Carolinas HealthCare System)

bd_b7a9f45807aead4a · schema v1 · pii pii-v1

Severity

Medium

Discovered

Oct 1, 2018

Filed

Nov 27, 2018

To disclose

8 weeks

Affected

Not disclosed

Linked

2 filings

Confidence

64%

Full breach record for Atrium Health (formerly Carolinas HealthCare System) →4 incidents on file

Atrium Health notified patients of a cyber incident involving its billing vendor, AccuDoc Solutions, Inc. An unauthorized third party accessed AccuDoc's databases between September 22 and September 29, 2018. Atrium Health was informed on October 1, 2018. Affected data included names, addresses, dates of birth, insurance info, medical record numbers, and in some cases Social Security numbers. Clinical records and financial account numbers were not accessed. Atrium Health engaged forensic investigators and contacted the FBI. Identity monitoring was offered to affected individuals.

J jump to incidentP pin to compareR raw source

California clockDiscovered Oct 1, 2018 → Notified Nov 27, 201857d ✓ CA 60-day OK8 weeks discovery → filing

Incident timeline

undetected · 9 days

discovery → filing · 8 weeks / 57 days

Sep 22, 2018

Begins

Oct 1, 2018

Discovered

Nov 27, 2018

Filed

vs. sector median

4 wks faster

This filing is one of 2 about the same incident.View merged incident

Part of AccuDoc Solutions, Inc. supply-chain incident (2018) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Oregon State AGbd_bc5b89a8f1f4522b2018-11-27Candidate

Name: Atrium Health (formerly Carolinas HealthCare System)
norm: atrium health formerly carolinas healthcare system

Name: Atrium Health (formerly Carolinas HealthCare System)
norm: atrium health formerly carolinas healthcare system
Industry: Healthcarellm

Discovered: Oct 1, 2018
Breach occurred: Sep 22, 2018 – Sep 29, 2018
Undetected for: 9 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 27, 2018
Affected individuals: Not disclosed
Data types: Identity (basic)Health (basic)Government ID
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain Compromise
Threat actor: External
Regulator citations: Contacted the Federal Bureau of Investigation (FBI)
Third party: via AccuDoc Solutions, Inc.
Initial access: supply_chain

During the incident: AccuDoc immediately terminated the unauthorized access
AccuDoc engaged a forensic investigator
AccuDoc took steps to secure its affected databases and enhance its security controls
AccuDoc continues to monitor its systems for any additional related activity
Atrium Health engaged its own nationally-recognized forensic investigator to conduct an independent review of the incident
Atrium Health reviewed its security safeguards
Both AccuDoc and Atrium Health have been in contact with the Federal Bureau of Investigation (FBI)
Changes made: Offered identity monitoring for a period of one year, free of charge, through Kroll
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(57 days from discovery to filing)
Compliance flags: CA 60-day OK · 57d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Oct 1, 2018
→ Notified: Nov 27, 2018
57d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Oct 1, 2018 → Notified: Nov 27, 2018	57d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Oregon State AGNov 27 · first

California State AGNov 27 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-142128
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 27, 2018
Raw hash: 4627614136fb030564b7e61539de17ad4c39096bfa7480b2483a384b37e04d35

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityAtrium Health (formerly Carolinas HealthCare System)

Victim entityAtrium Health (formerly Carolinas HealthCare System)

Incidentdiscovered Oct 1, 2018

Stated responseAccuDoc immediately terminated the unauthorized access

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov