MalwareHealthcareHealthcareRansomwareData ExfiltratedData EncryptedCustomer Data InvolvedIdentity (basic)Government IDPHIPIIHealth (basic)HighContained

Mt. Spokane Pediatrics

bd_d7dadd725c6c31f1 · schema v1 · pii pii-v1

Severity

High

Discovered

Jan 1, 2026

Filed

Apr 30, 2026

To disclose

17 weeks

Affected

29,410state residents only

Linked

5 filings

Confidence

69%

Full breach record for Mt. Spokane Pediatrics →

Mt. Spokane Pediatrics reported a ransomware incident on Jan 1, 2026, affecting 29,410 Washington residents. Unauthorized access led to exfiltration of PII and PHI. The organization contained the threat, engaged forensic investigators, and offered credit monitoring services.

J jump to incidentP pin to compareR raw source

Washington clock✗ WA AG >90d17 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 17 weeks / 119 days

Jan 1, 2026

Begins

Jan 1, 2026

Discovered

Apr 30, 2026

Filed

vs. sector median

+4 wks slower

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (2)

Leak Sitelockbit5bd_9a00b7b87dbe30882026-01-02 · +117dVerified
Leak Sitelockbit5bd_c934b72175f66e322025-12-28 · +123dVerified by operator

Regulatory filings (2) · sorted by filing gap

HHS OCRbd_d42a7bd021d488bf2026-04-30Verified
Illinois State AGbd_c985d6bc80f0c8c42026-04-01 · +29dVerified by operator

Name: Mt. Spokane Pediatrics
norm: mt spokane pediatrics
Domain: mtspokanepediatrics.com

Name: Mt. Spokane Pediatrics
norm: mt spokane pediatrics
Domain: mtspokanepediatrics.com
Industry: Healthcarellm

Discovered: Jan 1, 2026
Breach occurred: Jan 1, 2026
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 29,410state-resident count only
Data types: PIIPHIIdentity (basic)
Data elements: NameSocial Security numberHealth insurance IDMedical information
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 0dexposure 0d
WA-stated discovery: Found while ongoingContained same day
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial

During the incident: Contained the threat
Commenced a prompt and thorough investigation
Working very closely with external cybersecurity professionals
Offering a complimentary months membership of Single Bureau Credit Monitoring/Single Bureau Credit Report/Single Bureau Credit Score services
Providing proactive fraud assistance
Changes made: Continually evaluate and modify practices and internal controls to enhance the security and privacy of your information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 17 weeks(119 days from discovery to filing)
Compliance flags: WA AG >90dLeak >90d
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 2 states

View merged incident ↗

Illinois State AGApr 1 · first

HHS OCR+29d

Washington State AG+29d · this page

Pattern: first filing Apr 1 (IL), last Apr 30 (WA) — a 29-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA40273.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 30, 2026
Raw hash: 600292bd3e1b006a143288884f619e9856476cfcfb580da417508f7d8723c56f

Linked disclosures

Ransomware claims (2)

Regulatory filings (2) · sorted by filing gap

Reporting entityMt. Spokane Pediatrics

Victim entityMt. Spokane Pediatrics

Incidentdiscovered Jan 1, 2026

Stated responseContained the threat

ComplianceWA AG >90d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com