Social EngineeringHealthcareHealthcarePhishingStolen CredentialsCustomer Data InvolvedEmployee Data InvolvedMulti-Stage ChainIdentity (basic)Government IDHealth (basic)PHIMediumActive

Sunspire Health

bd_cfcc4c084e310634 · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 17, 2018

Filed

Jul 27, 2018

To disclose

10 weeks

Affected

10state residents only

Linked

5 filings

Confidence

65%

Full breach record for Sunspire Health →

Sunspire Health, a network of addiction treatment facilities, notified individuals of a data breach resulting from a phishing campaign that compromised employee email credentials between March 1 and May 4, 2018. The incident exposed patient information including names, DOBs, SSNs, and health data. Sunspire engaged forensic investigators, secured accounts, and offered credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 77 days

discovery → filing · 10 weeks / 71 days

Mar 1, 2018

Begins

May 17, 2018

Discovered

Jul 27, 2018

Filed

vs. sector median

+1 wks slower

This filing is one of 5 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Massachusetts State AGbd_4dc79ec473ff0af62018-07-27Verified
Oregon State AGbd_6b6d76f70c52ed832018-07-27Verified
New Hampshire State AGbd_8bbe907ad88eec4d2018-07-30 · +3dVerified
HHS OCRbd_8130adbe758812e02018-07-16 · +11dVerified

Name: Sunspire Health
norm: sunspire health
Domain: sunspirehealth.com

Name: Sunspire Health
norm: sunspire health
Domain: sunspirehealth.com
Industry: Healthcarellm

Discovered: May 17, 2018
Breach occurred: Mar 1, 2018 – May 4, 2018
Undetected for: 77 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 16, 2018
Affected individuals: 10state-resident count only
Data types: Identity (basic)Government IDHealth (basic)PHI
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: External
Regulator citations: Informing the U.S. Department of Health and Human ServicesNotifying appropriate state authorities
Initial access: phishing_link

During the incident: Secured the email accounts
Launched an in-depth investigation
Engaged third-party computer forensic investigators
Forcing password changes
Conducting analysis of the network and applications
Reviewed and made changes to existing security protocols
Offering one year of credit monitoring and identity theft restoration services through Kroll
Changes made: Implemented supplemental technical and administrative protections
Implemented training protocols
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 10 weeks(71 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

HHS OCRJul 16 · first

Massachusetts State AG+11d

Oregon State AG+11d

Montana State AG+11d · this page

New Hampshire State AG+14d

Pattern: first filing Jul 16 (NJ), last Jul 30 (NH) — a 14-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/Sunspire-Health.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 27, 2018
Raw hash: 78f25846c99a7f4f3cd43d37fc51b5bf66c59e60c0ce6c04399d092a2e34ec4d

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entitySunspire Health

Victim entitySunspire Health

Incidentdiscovered May 17, 2018

Stated responseSecured the email accounts

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov