HackingHealthcareHealthcareStolen CredentialsData ExfiltratedCustomer Data InvolvedPIIIdentity (basic)LowContained

Hayward Sisters Hospital

bd_c647bef5fc030ca8 · schema v1 · pii pii-v1

Severity

Low

Discovered

Nov 29, 2022

Filed

Aug 3, 2023

To disclose

35 weeks

Affected

7state residents only

Linked

4 filings

Confidence

66%

Full breach record for Hayward Sisters Hospital →2 incidents on file

Hayward Sisters Hospital d/b/a St. Rose Hospital notified individuals of a cybersecurity incident where an unknown actor accessed computer systems on or about November 18, 2022. Suspicious activity was discovered on November 29, 2022. The incident involved patient PII. The hospital engaged forensic specialists, cooperated with federal law enforcement, and offered 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 11 days

discovery → filing · 35 weeks / 247 days

Nov 18, 2022

Begins

Nov 29, 2022

Discovered

Aug 3, 2023

Filed

vs. sector median

+24 wks slower

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Massachusetts State AGbd_994c442098d902092023-08-03Verified
California State AGbd_a500dfc433c91c422023-08-03Candidate
Vermont State AGbd_dc8c78dd1cdb3d152023-08-03Verified

Name: Hayward Sisters Hospital
norm: hayward sisters hospital

Name: Hayward Sisters Hospital
norm: hayward sisters hospital
Also named: Hayward Sisters Hospitaldba oflegal entity
St. Rose Hospitaldba oftrade name
Industry: Healthcarellm

Discovered: Nov 29, 2022
Breach occurred: Nov 18, 2022
Undetected for: 11 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 3, 2023
Affected individuals: 7state-resident count only
Data types: PIIIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: notifying applicable regulators, including the U.S. Department of Health and Human Services
Initial access: valid_credentials

During the incident: Took steps to secure our systems
Initiated an investigation into the nature and scope of the event with the assistance of third-party computer forensic specialists
Federal law enforcement is aware of this incident, and we are cooperating with their investigation
Notifying applicable regulators, including the U.S. Department of Health and Human Services
Offering credit monitoring and identity theft protection services for 12 months through Experian
Changes made: Implemented additional security measures to further protect against similar incidents moving forward
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 35 weeks(247 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Massachusetts State AGAug 3 · first

California State AGAug 3 · first

Vermont State AGAug 3 · first

Montana State AGAug 3 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-notification-letter-514.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 3, 2023
Raw hash: 1f0729b0cf0fdff19d188b83a741c840be71214e24a48024226c6e82495cab59

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityHayward Sisters Hospital

Victim entityHayward Sisters Hospital

Incidentdiscovered Nov 29, 2022

Stated responseTook steps to secure our systems

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov