MalwareGovernmentGovernmentRansomwareData ExfiltratedData EncryptedCustomer Data InvolvedEmployee Data InvolvedMulti-Stage ChainFinancial accountHealth (basic)Identity (basic)Government IDPHIHighActive

Housing Authority of the City of Seattle

bd_c6f36822702d0e59 · schema v1 · pii pii-v1

Severity

High

Discovered

Oct 5, 2023

Filed

Nov 10, 2023

To disclose

5 weeks

Affected

50,738state residents only

Linked

2 filings

Confidence

70%

Full breach record for Housing Authority of the City of Seattle →3 incidents on file

Supplemental notice from Seattle Housing Authority regarding a ransomware incident discovered October 5, 2023. Unauthorized access occurred Aug 9–Oct 6, 2023. Data types include names, SSNs, driver's licenses, financial accounts, and health info. 50,738 Washington residents notified. SHA engaged forensic specialists, notified law enforcement, and provided credit monitoring.

J jump to incidentP pin to compareR raw source

Leak gap clock⏱ Leak >30d5 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 57 days

discovery → filing · 5 weeks / 36 days

Aug 9, 2023

Begins

Oct 5, 2023

Discovered

Nov 10, 2023

Filed

vs. sector median

6 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitenoescapebd_701658146146362a2023-10-05 · +36dVerified

Name: Housing Authority of the City of Seattle
norm: housing authority of the city of seattle
Domain: seattlehousing.org
Industry: Government

Name: Housing Authority of the City of Seattle
norm: housing authority of the city of seattle
Domain: seattlehousing.org
Industry: Government
Industry: Governmentllm

Discovered: Oct 5, 2023
Breach occurred: Aug 9, 2023 – Oct 6, 2023
Undetected for: 57 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 10, 2023
Affected individuals: 50,738state-resident count only
Data types: Identity (basic)Government IDFinancial accountHealth (basic)
Data elements: NameSocial Security numberDriver's licence numberFinancial account numberDate of birthPassport numberHealth insurance IDMedical information
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 1-99dexposure 1-99d
WA-stated discovery: Found while ongoing
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified Washington State Office of the Attorney GeneralNotified federal law enforcement

During the incident: Took steps to secure their systems
Launched an investigation with the assistance of cyber incident response specialists
Reported the event to federal law enforcement
Began providing notice to individuals on a rolling basis
Undertook a comprehensive review of the data at risk
Providing access to credit monitoring services for 1 year, through Epiq, to individuals whose personal information was potentially affected by this incident, at no cost to these individuals
Providing impacted individuals with guidance on how to better protect against identity theft and fraud
Changes made: Implementing additional safeguards and training to its employees
Continue to monitor these safeguards as part of our ongoing commitment to data security
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(36 days from discovery to filing)
Compliance flags: Leak >30dWA AG >30d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26988.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 10, 2023
Raw hash: 643a17e091487bc6fa4d8fee4b96102b32ee5fc77b9874dbfb4d8ffb017963ff

Linked disclosures

Ransomware claims (1)

Reporting entityHousing Authority of the City of Seattle

Victim entityHousing Authority of the City of Seattle

Incidentdiscovered Oct 5, 2023

Stated responseTook steps to secure their systems

ComplianceLeak >30d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com