MalwareHealthcareHealthcareDelayed DiscoveryIdentity (basic)Government IDHealth (basic)Financial accountMediumResolved

LIFEBRIDGE HEALTH, INC.

bd_de2bd6722c2d1ac4 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 18, 2018

Filed

May 15, 2018

To disclose

8 weeks

Affected

28state residents only

Linked

5 filings

Confidence

64%

Full breach record for LIFEBRIDGE HEALTH, INC. →3 incidents on file

LifeBridge Health notified patients of a malware incident discovered March 18, 2018, involving unauthorized access to patient registration and billing systems on September 27, 2016. Data accessed included names, addresses, DOBs, SSNs, and PHI. The organization engaged forensic investigators and offered credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 537 days

discovery → filing · 8 weeks / 58 days

Sep 27, 2016

Begins

Mar 18, 2018

Discovered

May 15, 2018

Filed

vs. sector median

4 wks faster

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

California State AGbd_018a5d74fcf1990d2018-05-15Candidate
Massachusetts State AGbd_20891729614f0a562018-05-15Verified
HHS OCRbd_9aba90d5aceb53c52018-05-15Verified
New Hampshire State AGbd_f6a45ced5be4c4852018-05-15Verified

Name: LIFEBRIDGE HEALTH, INC.
norm: lifebridge health
Domain: lifebridgehealth.org

Name: LIFEBRIDGE HEALTH, INC.
norm: lifebridge health
Domain: lifebridgehealth.org
Industry: Healthcarellm

Discovered: Mar 18, 2018
Breach occurred: Sep 27, 2016
Undetected for: 537 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 10, 2018
Affected individuals: 28state-resident count only
Data types: Identity (basic)Government IDHealth (basic)Financial account
Data elements: Social Security numberDate of birthMedical information
Attack vector: Unknown
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1078 Valid Accounts
Threat actor: External
Initial access: external_remote_services

During the incident: Began an investigation
Engaged a national forensic firm
Offering a free one-year membership of Experian’s® IdentityWorksTM Credit 3B
Changes made: Enhanced the complexity of our password requirements
Enhanced the security of our system
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(58 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

California State AGMay 15 · first

Massachusetts State AGMay 15 · first

HHS OCRMay 15 · first

New Hampshire State AGMay 15 · first

Montana State AGMay 15 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/LifeBridge-Health.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 15, 2018
Raw hash: faf55114a13450b1c71ec9933a501cb820f5b9a5606930368c5204a6f94178a7

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityLIFEBRIDGE HEALTH, INC.

Victim entityLIFEBRIDGE HEALTH, INC.

Incidentdiscovered Mar 18, 2018

Stated responseBegan an investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov