MalwareHealthcareHealthcareRansomwareData ExfiltratedCustomer Data InvolvedData EncryptedPHIIdentity (basic)Government IDHealth (basic)Financial accountHighContained

Brandywine Counseling & Community Services, Inc

bd_c10e14cbc46cd640 · schema v1 · pii pii-v1

Severity

High

Discovered

Feb 10, 2020

Filed

Apr 10, 2020

To disclose

9 weeks

Affected

3,022state residents only

Linked

4 filings

Confidence

67%

Full breach record for Brandywine Counseling & Community Services, Inc →4 incidents on file

Brandywine Counseling & Community Services, Inc. (BCCS), a Delaware nonprofit healthcare provider, disclosed a ransomware incident discovered on February 10, 2020. The attack affected 3,022 Delaware residents, exposing names, dates of birth, health insurance info, limited clinical treatment data, and for 2,805 individuals, Social Security numbers and/or driver's license numbers. BCCS engaged forensic investigators and law enforcement, secured the network, and began notifying affected individuals on April 10, 2020, offering one year of credit monitoring via Kroll.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 9 weeks / 60 days

Feb 10, 2020

Discovered

Apr 10, 2020

Filed

vs. sector median

3 wks faster

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

HHS OCRbd_9748f256d3c9ea602020-04-10Candidate
Massachusetts State AGbd_a71ac6c4c86ef5dd2020-05-13 · +33dVerified
New Hampshire State AGbd_1dac72592e399a4c2020-05-14 · +34dVerified

Name: Brandywine Counseling & Community Services, Inc
norm: brandywine counseling community

Name: Brandywine Counseling & Community Services, Inc
norm: brandywine counseling community
Industry: Healthcarellm

Discovered: Feb 10, 2020
Materiality determined: —
Notification sent: Apr 10, 2020
Affected individuals: 3,022state-resident count only
Data types: Identity (basic)Government IDPHIHealth (basic)
Data elements: Social Security numberDate of birthMedical information
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for Impact
Threat actor: ExternalFinancial
Regulator citations: Notified Delaware Attorney General's Office

During the incident: Took steps to secure its network
Began an investigation to determine what occurred and what information may have been affected
Hired an experienced computer forensic firm to assist
Alerted law enforcement and is assisting with their investigation
Established a dedicated toll-free call center
Offered eligible individuals a complimentary, one-year membership to credit monitoring and identity theft protection services
Changes made: Reviewing its systems and implementing additional measures to enhance and strengthen its security processes
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(60 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 3 states

View merged incident ↗

HHS OCRApr 10 · first

Delaware State AGApr 10 · first · this page

Massachusetts State AG+33d

New Hampshire State AG+34d

Pattern: first filing Apr 10 (DE), last May 14 (NH) — a 34-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://attorneygeneral.delaware.gov/wp-content/uploads/sites/50/2020/06/BCCS_DE-AG-Appendix.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 10, 2020
Raw hash: b59e8af81e7807c99ff79ff521b2b831392221afcad5b3ae4b8f45f8184b7856

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityBrandywine Counseling & Community Services, Inc

Victim entityBrandywine Counseling & Community Services, Inc

Incidentdiscovered Feb 10, 2020

Stated responseTook steps to secure its network

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceattorneygeneral.delaware.gov