MalwareHealthcareHealthcareRansomwareData EncryptedTargetedAuthenticationFinancial accountHealth (basic)Identity (basic)Government IDPHIHighActive

UNITED BACKCARE

bd_d92bb17e977f2c81 · schema v1 · pii pii-v1

Severity

High

Discovered

Dec 30, 2024

Filed

Jan 30, 2025

To disclose

4 weeks

Affected

18,600state residents only

Linked

2 filings

Confidence

70%

Full breach record for UNITED BACKCARE →

United Backcare DBA Pacific Rehabilitation Centers experienced a ransomware attack on December 30, 2024. The incident encrypted patient, employee, and contractor data including names, SSNs, health info, and banking details. 18,600 Washington residents were affected. Servers were taken offline and forensic investigation is ongoing.

J jump to incidentP pin to compareR raw source

Washington clock⏱ WA AG >30d4 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 4 weeks / 31 days

Dec 30, 2024

Begins

Dec 30, 2024

Discovered

Jan 30, 2025

Filed

vs. sector median

5 wks faster

This filing is one of 2 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

HHS OCRbd_554f4396191353fd2025-02-11 · +12dVerified

Name: UNITED BACKCARE
norm: united backcare

Name: UNITED BACKCARE
norm: united backcare
Also named: UNITED BACKCAREdba oflegal entity
Pacific Rehabiliation Centersdba oftrade name
Industry: Healthcarellm

Discovered: Dec 30, 2024
Breach occurred: Dec 30, 2024
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 18,600state-resident count only
Data types: Identity (basic)Government IDFinancial accountHealth (basic)PHI
Data elements: NameSocial Security numberDriver's licence numberFinancial account numberDate of birthUnique private keyPassport numberHealth insurance IDMedical information
WA-stated cause: Cyberattack
WA-stated duration: lifecycle Unknowndexposure Unknownd
WA-stated discovery: Found after the fact
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for Impact
Threat actor: ExternalFinancial
Initial access: phishing_link

During the incident: Initiated security measures and took servers offline
Engaged forensic investigation
Transitioned to secure alternative systems within 24 hours
Implemented enhanced security measures on all company devices
Leading transition to an upgraded electronic health records system
Changes made: Transitioned to secure alternative systems within 24 hours to ensure uninterrupted patient care
Enhanced security measures have been implemented on all company devices
Leading the transition to an upgraded electronic health records system
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 4 weeks(31 days from discovery to filing)
Compliance flags: WA AG >30d
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings

View merged incident ↗

Washington State AGJan 30 · first · this page

HHS OCR+12d

Pattern: first filing Jan 30 (WA), last Feb 11 (WA) — a 12-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA32086.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 30, 2025
Raw hash: fd9a648c7689da44b509ad4d758c67f44994362b2a03adb9fe5d7a28b505ddf5

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityUNITED BACKCARE

Victim entityUNITED BACKCARE

Incidentdiscovered Dec 30, 2024

Stated responseInitiated security measures and took servers offline

ComplianceWA AG >30d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com