AccidentalHealthcareHealthcareMisdeliveryCustomer Data InvolvedIdentity (basic)PHIPIIHealth (basic)LowResolved

Kadlec Clinic

bd_e17d81530c71f94e · schema v1 · pii pii-v1

Severity

Low

Discovered

Aug 22, 2025

Filed

Oct 15, 2025

To disclose

8 weeks

Affected

992state residents only

Confidence

70%

Full breach record for Kadlec Clinic →

Kadlec Clinic, a subsidiary of Providence, experienced a data privacy event on August 19, 2025, when a technical error during the printing and mailing of closure letters resulted in patients receiving mailers with other patients' names. The error was discovered on August 22, 2025. Approximately 992 Washington residents were affected. The disclosed data was limited to names and provider/clinic names. Notices were mailed in October 2025.

J jump to incidentP pin to compareR raw source

Washington clock⏱ WA AG >30d8 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 3 days

discovery → filing · 8 weeks / 54 days

Aug 19, 2025

Begins

Aug 22, 2025

Discovered

Oct 15, 2025

Filed

vs. sector median

5 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed992 affectedView incident

Name: Providence Health & Services
norm: providence health services

Name: Kadlec Clinic
norm: kadlec clinic
Industry: Healthcarellm

Discovered: Aug 22, 2025
Breach occurred: Aug 19, 2025
Undetected for: 3 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 14, 2025
Affected individuals: 992state-resident count only
Data types: Identity (basic)PII
Data elements: NameMedical information
WA-stated cause: Theft or Mistake
WA-stated duration: lifecycle 1-99dexposure 0d
WA-stated discovery: Found after the fact
Attack vector: Misconfiguration
MITRE ATT&CK: T1530 Data from Cloud Storage Object

During the incident: Conducted a thorough review to understand how this happened
Notifying patients to be transparent and out of an abundance of caution
Changes made: Ensuring that precautions are being taken to prevent it from happening again
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(54 days from discovery to filing)
Compliance flags: WA AG >30d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34956.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 15, 2025
Raw hash: cb1f5eda24bbde87758c53618b6f68baf33284f204e92b64c8e3b345e828e5e6

Reporting entityProvidence Health & Services

Victim entityKadlec Clinic

Incidentdiscovered Aug 22, 2025

Stated responseConducted a thorough review to understand how this happened

ComplianceWA AG >30d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com