Social EngineeringHealthcareHealthcarePhishingTargetedPHIHealth (basic)Identity (basic)MediumContained

KAISER FOUNDATION HEALTH PLAN OF WASHINGTON

bd_df9e929766056ffb · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 5, 2022

Filed

Jun 3, 2022

To disclose

8 weeks

Affected

69,589state residents only

Linked

2 filings

Confidence

70%

Full breach record for KAISER FOUNDATION HEALTH PLAN OF WASHINGTON →

Kaiser Foundation Health Plan of Washington notified the Washington AG of a breach discovered on April 5, 2022, where an unauthorized party accessed an employee's email via phishing. PHI including names, medical record numbers, dates of service, and lab results was potentially exposed for 69,589 Washington patients. Access was terminated within hours; no SSN or financial data was involved.

J jump to incidentP pin to compareR raw source

Washington clock⏱ WA AG >30d8 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 8 weeks / 59 days

Apr 5, 2022

Begins

Apr 5, 2022

Discovered

Jun 3, 2022

Filed

vs. sector median

4 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

HHS OCRbd_32973e48c6640d6a2022-06-03Candidate

Name: KAISER FOUNDATION HEALTH PLAN OF WASHINGTON
norm: kaiser foundation health plan of washington

Name: KAISER FOUNDATION HEALTH PLAN OF WASHINGTON
norm: kaiser foundation health plan of washington
Industry: Healthcarellm

Discovered: Apr 5, 2022
Breach occurred: Apr 5, 2022
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 69,589state-resident count only
Data types: PHIHealth (basic)Identity (basic)
Data elements: NameMedical information
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 0dexposure 0d
WA-stated discovery: Found while ongoingContained same day
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid Accounts
Threat actor: External
Regulator citations: Notified Department of Health and Human Services’ Office for Civil Rights
Initial access: phishing_link

During the incident: Terminated the unauthorized party’s access to the employee’s emails
Resetting the employee’s password for the email account where unauthorized activity was detected
The employee received additional training on safe email practices
Contacted affected patients by mail directly
Changes made: The employee received additional training on safe email practices
Exploring other steps to ensure incidents like this do not happen in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(59 days from discovery to filing)
Compliance flags: WA AG >30d
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings

View merged incident ↗

HHS OCRJun 3 · first

Washington State AGJun 3 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA11624.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 3, 2022
Raw hash: ecd109e774089b38dc889c12cd08e418884d102d7fdabca710358df72e8e88ff

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityKAISER FOUNDATION HEALTH PLAN OF WASHINGTON

Victim entityKAISER FOUNDATION HEALTH PLAN OF WASHINGTON

Incidentdiscovered Apr 5, 2022

Stated responseTerminated the unauthorized party’s access to the employee’s emails

ComplianceWA AG >30d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com