HackingHealthcareTechnologyHealthcareData ExfiltratedCustomer Data InvolvedBusiness Associate (HIPAA)PHIHealth (basic)Identity (basic)LowContained

Clinical Registry Solutions

bd_cf661af5a4e58e57 · schema v1 · pii pii-v1

Severity

Low

Discovered

Apr 9, 2026

Filed

Jun 11, 2026

To disclose

9 weeks

Affected

Not disclosed

Linked

10 filings

Confidence

66%

Full breach record for Clinical Registry Solutions →

Clinical Registry Solutions (CRS), a vendor providing registry support services to Dignity Health – St. Mary's Medical Center, discovered unauthorized access to its network on April 9, 2026. The incident involved the acquisition of files containing patient information, including names, medical record numbers, and procedure dates. CRS secured its network, investigated the scope, and notified affected individuals. No evidence of misuse was found.

J jump to incidentP pin to compareR raw source

Leak gap clock⏱ Leak >30d9 weeks discovery → filing

Incident timeline

discovery → filing · 9 weeks / 63 days

Apr 9, 2026

Begins

Apr 9, 2026

Discovered

Jun 11, 2026

Filed

vs. sector median

3 wks faster

This filing is one of 10 about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (2)

Leak Siteakirabd_f828cc6ad7ec7ecc2026-05-06 · +36dVerified by operator
Leak Siteakirabd_401d01df51fe3e5f2026-04-09 · +63dVerified by operator

Regulatory filings (7) · sorted by filing gap

New Hampshire State AGbd_f331216109245cf42026-06-11Verified
HHS OCRbd_fe5df6567cc5082d2026-06-12 · +1dVerified
Nebraska State AGbd_3dde56a6b54fc5f22026-06-17 · +6dVerified by operator
Indiana State AGbd_8e3980e02c3b30f22026-06-17 · +6dVerified

Show 3 more filings ↓up to 48d gap

Massachusetts State AGbd_769d7856f7ce42202026-06-25 · +14dVerified by operator
California State AGbd_84ea03610972f25d2026-07-29 · +48dVerified by operator
California State AGbd_b568d923923502902026-07-29 · +48dVerified by operator

Name: Clinical Registry Solutions
norm: clinical registry
Domain: clinicalregistrysolutions.com

Name: Clinical Registry Solutions
norm: clinical registry
Domain: clinicalregistrysolutions.com
Industry: HealthcarellmTechnologyllm

Discovered: Apr 9, 2026
Breach occurred: Apr 9, 2026
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: PHIHealth (basic)Identity (basic)
Attack vector: Unknown
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External

During the incident: Took immediate steps to secure its network
Conducted an investigation into the nature and scope of the incident
Reviewed the data involved to determine whether it contained any protected health information or sensitive personal information
Identified to whom the information belonged
Promptly notified those individuals
Established a dedicated assistance line through TransUnion
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(63 days from discovery to filing)
Compliance flags: Leak >30d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 6 states

View merged incident ↗

New Hampshire State AGJun 11 · first

California State AGJun 11 · first · this page

HHS OCR+1d

Nebraska State AG+6d

Indiana State AG+6d

Massachusetts State AG+14d

California State AG+48d

Pattern: first filing Jun 11 (NH), last Jul 29 (CA) — a 48-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-624728
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 11, 2026
Raw hash: 415e5145b73d72ec7aeeb38792752f6d2744e2936ae6d6e4767fcab123a2348a

Linked disclosures

Ransomware claims (2)

Regulatory filings (7) · sorted by filing gap

Reporting entityClinical Registry Solutions

Victim entityClinical Registry Solutions

Incidentdiscovered Apr 9, 2026

Stated responseTook immediate steps to secure its network

ComplianceLeak >30d

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov