HackingHealthcareHealthcareStolen CredentialsData ExfiltratedCustomer Data InvolvedEmployee Data InvolvedAuthenticationEmploymentIdentity (basic)Government IDHighContained

Swedish Health Services

bd_c270e77924455fb8 · schema v1 · pii pii-v1

Severity

High

Discovered

Jan 15, 2020

Filed

May 29, 2020

To disclose

19 weeks

Affected

12,573state residents only

Confidence

71%

Full breach record for Swedish Health Services →

Swedish Health Services reported a data breach where unauthorized users obtained login credentials of Providence Health & Services caregivers. The attackers accessed a file containing PII, SSNs, and employment data of 12,901 caregivers. The incident was discovered on Jan 15, 2020, and notifications were sent on May 29, 2020. MFA was implemented as remediation.

J jump to incidentP pin to compareR raw source

Washington clock✗ WA AG >90d19 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 28 days

discovery → filing · 19 weeks / 135 days

Dec 18, 2019

Begins

Jan 15, 2020

Discovered

May 29, 2020

Filed

vs. sector median

+8 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed12,573 affectedView incident

Name: Swedish Health Services
norm: swedish health
Domain: swedish.org

Name: Swedish Health Services
norm: swedish health
Domain: swedish.org
Industry: Healthcarellm

Discovered: Jan 15, 2020
Breach occurred: Dec 18, 2019
Undetected for: 28 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 29, 2020
Affected individuals: 12,573state-resident count only
Data types: AuthenticationEmploymentIdentity (basic)Government ID
Data elements: NameSocial Security numberDate of birthUsername + password
WA-stated cause: Unauthorized Access
WA-stated duration: lifecycle 1-99dexposure 0d
WA-stated discovery: Found after the fact
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: Notified Washington Attorney General Consumer Protection Division
Initial access: valid_credentials

During the incident: Engaged an outside cybersecurity firm to conduct a thorough investigation
Pushed out a mandatory password change program
Implemented multi-factor authentication for Microsoft Office 365
Implemented multi-factor authentication for Citrix
Notified affected Washington residents via regular mail
Offered one-year membership of identity theft protection services through ID Experts
Changes made: Implemented multi-factor authentication for Microsoft Office 365
Implemented multi-factor authentication for Citrix
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 19 weeks(135 days from discovery to filing)
Compliance flags: WA AG >90d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10554.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 29, 2020
Raw hash: 4ea2c91ba9b788474553d47cb4d34f780ad399488b91eac261f4b7fea3d672b0

Reporting entitySwedish Health Services

Victim entitySwedish Health Services

Incidentdiscovered Jan 15, 2020

Stated responseEngaged an outside cybersecurity firm to conduct a thorough investigation

ComplianceWA AG >90d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com