HackingHealthcareHealthcareStolen CredentialsTargetedCustomer Data InvolvedIdentity (basic)Health (basic)LowContained

Vitalant

bd_da3f386bd0e3969c · schema v1 · pii pii-v1

Severity

Low

Discovered

Aug 1, 2019

Filed

Sep 12, 2019

To disclose

6 weeks

Affected

2state residents only

Confidence

65%

Full breach record for Vitalant →

Vitalant notified Montana residents of a data breach affecting blood donor profiles on its eDonor portal. Unauthorized access occurred between July 28 and August 22, 2019, via compromised credentials. Affected data included names, contact info, and health/wellness metrics. Vitalant reset passwords and restored fraudulent loyalty points.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 4 days

discovery → filing · 6 weeks / 42 days

Jul 28, 2019

Begins

Aug 1, 2019

Discovered

Sep 12, 2019

Filed

vs. sector median

5 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed2 affectedView incident

Name: Vitalant
norm: vitalant
Domain: vitalant.org

Name: Vitalant
norm: vitalant
Domain: vitalant.org
Industry: Healthcarellm

Discovered: Aug 1, 2019
Breach occurred: Jul 28, 2019 – Aug 22, 2019
Undetected for: 4 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 12, 2019
Affected individuals: 2state-resident count only
Data types: Identity (basic)Health (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1056 Input Capture
Threat actor: ExternalFinancial
Initial access: valid_credentials

During the incident: Notified impacted donors by email
Asked donors to change their password
Deactivated current passwords for non-responsive donors
Restored all fraudulently redeemed loyalty program points
Changes made: Working with software vendor Haemonetics Software Solutions to investigate
Continuing to closely monitor donor portal and computer systems
Monitoring for unauthorized access resulting from password attacks
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(42 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/General-Notice-6.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 12, 2019
Raw hash: 5c902114ab91d94a95571f6b12735e465b90d7a7003f839ba9c0187bd327e635

Reporting entityVitalant

Victim entityVitalant

Incidentdiscovered Aug 1, 2019

Stated responseNotified impacted donors by email

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov