HackingHealthcareHealthcareSupply Chain (3P Vendor)Customer Data InvolvedDelayed DiscoveryPHIHealth (basic)Identity (basic)LowContained

Sutter North Surgery Center

bd_d8ebf2f35ab81bb7 · schema v1 · pii pii-v1

Severity

Low

Discovered

Feb 9, 2022

Filed

Sep 8, 2023

To disclose

19 months

Affected

Not disclosed

Linked

2 filings

Confidence

65%

Full breach record for Sutter North Surgery Center →

Sutter North Surgery Center notified California residents that their protected health information may have been accessed by an unauthorized actor via its vendor, Sightpath Medical, LLC. Sightpath discovered unusual activity on February 9, 2022, and determined PHI was involved on June 14, 2023. The incident is contained. Complimentary identity protection services are offered.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 19 months / 576 days

Feb 9, 2022

Begins

Feb 9, 2022

Discovered

Sep 8, 2023

Filed

vs. sector median

+71 wks slower

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

HHS OCRbd_7ded52559e476f082023-09-08Verified by operator

Name: Sutter North Surgery Center
norm: sutter north surgery center

Name: Sutter North Surgery Center
norm: sutter north surgery center
Industry: Healthcarellm

Discovered: Feb 9, 2022
Breach occurred: Feb 9, 2022
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: PHIHealth (basic)Identity (basic)
Attack vector: Unknown
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Third party: via Sightpath Medical, LLC

During the incident: Took steps to secure our digital environment
Engaged a dedicated team of external cybersecurity experts to assist us in responding to and investigating the incident
Launched a comprehensive review of all potentially affected information to identify the individuals and information involved
Offering complimentary identity protection services through Experian IdentityWorks
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 19 months(576 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings

View merged incident ↗

HHS OCRSep 8 · first

California State AGSep 8 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-573050
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 8, 2023
Raw hash: 6d24be6b816d986930bea0e0502f7cc75d3c96be820da8613679cfbe1bf17abd

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entitySutter North Surgery Center

Victim entitySutter North Surgery Center

Incidentdiscovered Feb 9, 2022

Stated responseTook steps to secure our digital environment

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov