HackingCustomer Data InvolvedEmployee Data InvolvedIDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTPHIHEALTH_BASICMediumContained
SANTA BARBARA COTTAGE HOSPITAL FOUNDATION
bd_cbcabbbc7864f2f4 · schema v1 · pii pii-v1
Full breach record for SANTA BARBARA COTTAGE HOSPITAL FOUNDATION →Cottage Hospital notified consumers of a data breach where unauthorized access occurred between Oct 14-21, 2025. Compromised data included names, SSNs, driver's licenses, bank account info, and PHI. The hospital engaged third-party experts, offered credit monitoring, and enhanced security measures.
Vermont clock⏱ VT AG >14 bday9 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
This filing is one of 4 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (3) · sorted by filing gap
- bd_19e0e591936940d3Indiana State AGfiled 2026-02-06Verified
- bd_d149bc707a8e105fHHS OCRfiled 2026-02-06Verified
- bd_e21be11ad387c973New Hampshire State AGfiled 2026-02-06Verified
Source provenance
- Source URL
- https://ago.vermont.gov/document/2026-02-06-cottage-hospital-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Feb 6, 2026
- Raw hash
- 2a4746d35cb2a137827bb4d54068399573b8232d8b3db3cdbb88d86294a122a4
Reporting entity
- Name
- SANTA BARBARA COTTAGE HOSPITAL FOUNDATIONnorm: santa barbara cottage hospital
Victim entity
- Name
- SANTA BARBARA COTTAGE HOSPITAL FOUNDATIONnorm: santa barbara cottage hospital
Incident
- Discovered
- Dec 8, 2025
- Materiality determined
- Feb 6, 2026
- Notification sent
- Feb 6, 2026
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTPHIHEALTH_BASIC
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
- Threat actor
- ExternalFinancial
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 9 weeks(60 days from discovery to filing)
- Compliance flags
- VT AG >14 bday
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.