HackingHealthcareHealthcareStolen CredentialsData ExfiltratedTargetedIdentity (basic)LowContained

Hayward Sisters Hospital

bd_dc8c78dd1cdb3d15 · schema v1 · pii pii-v1

Severity

Low

Discovered

Nov 29, 2022

Filed

Aug 3, 2023

To disclose

35 weeks

Affected

Not disclosed

Linked

4 filings

Confidence

66%

Full breach record for Hayward Sisters Hospital →2 incidents on file

Hayward Sisters Hospital dba St. Rose Hospital notified consumers of a data breach where an unknown actor accessed computer systems and acquired files containing patient names. The incident occurred on November 18, 2022, and was discovered on November 29, 2022. The hospital engaged forensic specialists, notified law enforcement and HHS, and is offering 12 months of credit monitoring. No evidence of fraud was found.

J jump to incidentP pin to compareR raw source

Vermont clock✗ VT AG >45 bday35 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 11 days

discovery → filing · 35 weeks / 247 days

Nov 18, 2022

Begins

Nov 29, 2022

Discovered

Aug 3, 2023

Filed

vs. sector median

+24 wks slower

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Massachusetts State AGbd_994c442098d902092023-08-03Verified
California State AGbd_a500dfc433c91c422023-08-03Candidate
Montana State AGbd_c647bef5fc030ca82023-08-03Verified

Name: Hayward Sisters Hospital
norm: hayward sisters hospital

Name: Hayward Sisters Hospital
norm: hayward sisters hospital
Also named: Hayward Sisters Hospitaldba oflegal entity
St. Rose Hospitaldba oftrade name
Industry: Healthcarellm

Discovered: Nov 29, 2022
Breach occurred: Nov 18, 2022
Undetected for: 11 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 3, 2023
Affected individuals: Not disclosed
Data types: Identity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified federal law enforcementNotifying applicable regulators, including the U.S. Department of Health and Human Services
Initial access: valid_credentials

During the incident: Took steps to secure systems
Initiated investigation with third-party computer forensic specialists
Performed a full investigation
Implemented additional security measures
Notified federal law enforcement and cooperating with their investigation
Notifying applicable regulators, including the U.S. Department of Health and Human Services
Offering credit monitoring and identity theft protection services for 12 months through Experian
Changes made: Implemented additional security measures to further protect against similar incidents moving forward
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 35 weeks(247 days from discovery to filing)
Compliance flags: VT AG >45 bday
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Massachusetts State AGAug 3 · first

California State AGAug 3 · first

Montana State AGAug 3 · first

Vermont State AGAug 3 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ago.vermont.gov/document/2023-08-03-hayward-sisters-hospital-dba-st-rose-hospital-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 3, 2023
Raw hash: 4004a17bef4830036fc1031c0b88a155b751cfad78c280cfdd2674283cde7cf6

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityHayward Sisters Hospital

Victim entityHayward Sisters Hospital

Incidentdiscovered Nov 29, 2022

Stated responseTook steps to secure systems

ComplianceVT AG >45 bday

Extraction provenanceno artifact recorded

Source provenanceago.vermont.gov