HackingHealthcareHealthcareStolen CredentialsCapture Stored DataTargetedData ExfiltratedDelayed DiscoveryIdentity (basic)Government IDHealth (basic)PHIMediumContained

Hunt Regional Medical Center

bd_e6c67f6645f61743 · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 14, 2019

Filed

Oct 7, 2019

To disclose

21 weeks

Affected

40state residents only

Linked

2 filings

Confidence

66%

Hunt Regional Medical Center notified patients of a targeted cyber attack dating back to May 2018, discovered on May 14, 2019. Hackers accessed patient records containing PII, SSN, DOB, and PHI. The company engaged forensic experts, cooperated with the FBI, and offered credit monitoring. No specific count of affected individuals was provided in this notice.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 378 days

discovery → filing · 21 weeks / 146 days

May 1, 2018

Begins

May 14, 2019

Discovered

Oct 7, 2019

Filed

vs. sector median

+9 wks slower

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

California State AGbd_b6b3b34268da3d9c2019-10-09 · +2dVerified

Name: Hunt Regional Medical Center
norm: hunt regional medical center

Name: Hunt Regional Medical Center
norm: hunt regional medical center
Industry: Healthcarellm

Discovered: May 14, 2019
Breach occurred: May 1, 2018
Undetected for: 378 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 7, 2019
Affected individuals: 40state-resident count only
Data types: Identity (basic)Government IDHealth (basic)PHI
Data elements: Social Security numberDate of birthMedical information
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: Cooperating with the FBI
Initial access: valid_credentials

During the incident: Cooperating with the FBI in its investigation
Retained the services of cyber security professionals to further investigate
Reinforced security protocols
Increased employee training
Enhanced threat detection and monitoring capabilities
Implementing additional safeguards to strengthen data security
Offering identity protection services through ID Experts
Changes made: Reinforced security protocols
Increased employee training
Enhanced threat detection and monitoring capabilities
Implementing additional safeguards to strengthen data security
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 21 weeks(146 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Montana State AGOct 7 · first · this page

California State AG+2d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-23.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 7, 2019
Raw hash: 66a0920e5d4689af1b84c07a4f837986235af5e8e6339cbea760151ae9fd0f22

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityHunt Regional Medical Center

Victim entityHunt Regional Medical Center

Incidentdiscovered May 14, 2019

Stated responseCooperating with the FBI in its investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov