HackingHealthcareHealthcareStolen CredentialsTargetedIdentity (basic)Government IDMediumContained

HOSPITAL SISTERS HEALTH SYSTEM

bd_bcf01a0e6248bc70 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 27, 2023

Filed

Aug 30, 2024

To disclose

12 months

Affected

1state residents only

Linked

3 filings

Confidence

66%

Full breach record for HOSPITAL SISTERS HEALTH SYSTEM →14 incidents on file

Hospital Sisters Health System (HSHS) notified Montana residents of a cybersecurity incident discovered on August 27, 2023. An unauthorized third party gained temporary access to HSHS's network between August 16 and August 27, 2023. The incident potentially exposed personal information including names, addresses, dates of birth, Social Security numbers, and/or driver's license numbers. HSHS engaged forensic investigators, reported the incident to law enforcement, and enhanced technical security measures. Affected individuals were offered a one-year Experian IdentityWorks membership.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 11 days

discovery → filing · 12 months / 369 days

Aug 16, 2023

Begins

Aug 27, 2023

Discovered

Aug 30, 2024

Filed

vs. sector median

+40 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Indiana State AGbd_a0a1bd6d4142f9b52024-08-30Verified
Massachusetts State AGbd_a5d599f62d4105f12024-08-30Verified

Name: HOSPITAL SISTERS HEALTH SYSTEM
norm: hospital sisters health system

Name: HOSPITAL SISTERS HEALTH SYSTEM
norm: hospital sisters health system
Industry: Healthcarellm

Discovered: Aug 27, 2023
Breach occurred: Aug 16, 2023 – Aug 27, 2023
Undetected for: 11 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security numberDate of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: reported the incident to law enforcement
Initial access: valid_credentials

During the incident: Took steps to contain and remediate the incident
Launched an internal investigation
Reported the incident to law enforcement
Engaged a leading forensic security firm to assist in our investigation and confirm the security of our computer systems and network
Changes made: Enhancing our technical security measures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 12 months(369 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Indiana State AGAug 30 · first

Massachusetts State AGAug 30 · first

Montana State AGAug 30 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-notification-letter-1649.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 30, 2024
Raw hash: 92c61311695d4f09b71c4113c637b291b7706bef40d3bb113488cfea0549609a

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityHOSPITAL SISTERS HEALTH SYSTEM

Victim entityHOSPITAL SISTERS HEALTH SYSTEM

Incidentdiscovered Aug 27, 2023

Stated responseTook steps to contain and remediate the incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov