HackingHealthcareProfessional ServicesHealthcareCustomer Data InvolvedPIIIdentity (basic)PHILowContained

Sonoma Recovery Services, LLC

bd_e5bb419ecf42b83e · schema v1 · pii pii-v1

Severity

Low

Discovered

Aug 7, 2020

Filed

Dec 15, 2020

To disclose

19 weeks

Affected

2state residents only

Linked

3 filings

Confidence

64%

Full breach record for Sonoma Recovery Services, LLC →2 incidents on file

Sonoma Recovery Services d/b/a Olympia House notified Montana residents of unauthorized access to systems between July 1 and August 7, 2020. Suspicious activity was detected on August 7, 2020. Impacted data included names, addresses, and protected health information. The company engaged forensic experts, secured systems, notified HHS, and offered 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 37 days

discovery → filing · 19 weeks / 130 days

Jul 1, 2020

Begins

Aug 7, 2020

Discovered

Dec 15, 2020

Filed

vs. sector median

+10 wks slower

This filing is one of 3 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

California State AGbd_18042ada54c215b52020-12-15Candidate
Massachusetts State AGbd_ac90964aa8f608f92020-12-15Verified

Name: Sonoma Recovery Services, LLC
norm: sonoma recovery

Name: Sonoma Recovery Services, LLC
norm: sonoma recovery
Also named: Sonoma Recovery Servicesdba oflegal entity
Olympia Housedba oftrade name
Industry: HealthcarellmProfessional Servicesllm

Discovered: Aug 7, 2020
Breach occurred: Jul 1, 2020 – Aug 7, 2020
Undetected for: 37 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 15, 2020
Affected individuals: 2state-resident count only
Data types: PIIIdentity (basic)PHI
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: notifying the required regulators of the event including the U.S. Department of Health and Human Services

During the incident: Began an investigation to determine the nature and scope of the event
Working with third-party forensic experts
Ensured that our systems were secure
Notifying the required regulators of the event including the U.S. Department of Health and Human Services
Providing you with access to twelve (12) months of credit monitoring and identity protection services from Experian at no cost to you
Changes made: Taking steps to implement additional safeguards
Review policies and procedures relating to data privacy and security
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 19 weeks(130 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

California State AGDec 15 · first

Massachusetts State AGDec 15 · first

Montana State AGDec 15 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/nomaSamp.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 15, 2020
Raw hash: 24dea5c5389b84789d3a6efd42430dbacbb80af5e1ee7d5494270abb4bf348d2

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entitySonoma Recovery Services, LLC

Victim entitySonoma Recovery Services, LLC

Incidentdiscovered Aug 7, 2020

Stated responseBegan an investigation to determine the nature and scope of the event

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov