HackingHealthcareHealthcareData ExfiltratedCustomer Data InvolvedPHIIdentity (basic)Government IDHealth (basic)Financial accountMediumContained

Palo Verde Hospital

bd_e9577583ba05999a · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 6, 2025

Filed

Apr 24, 2025

To disclose

7 weeks

Affected

Not disclosed

Linked

2 filings

Confidence

66%

Full breach record for Palo Verde Hospital →2 incidents on file

Palo Verde Hospital experienced unauthorized access to its IT systems between March 3 and March 6, 2025. The incident was discovered on March 6, 2025. An unauthorized party accessed or removed files containing protected health information, including names, SSNs, medical records, and some financial account data. The hospital contained the incident, engaged forensic experts, notified law enforcement, and is offering one year of identity monitoring to affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 3 days

discovery → filing · 7 weeks / 49 days

Mar 3, 2025

Begins

Mar 6, 2025

Discovered

Apr 24, 2025

Filed

vs. sector median

6 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

HHS OCRbd_a314dc70fe8af37f2025-04-24Verified

Name: Palo Verde Hospital
norm: palo verde hospital

Name: Palo Verde Hospital
norm: palo verde hospital
Industry: Healthcarellm

Discovered: Mar 6, 2025
Breach occurred: Mar 3, 2025 – Mar 6, 2025
Undetected for: 3 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: PHIIdentity (basic)Government IDHealth (basic)Financial account
Data elements: Social Security numberDate of birthMedical information
Attack vector: Unknown
MITRE ATT&CK: T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
Threat actor: External

During the incident: Took steps to secure our systems and contain the incident
Launched an investigation with the assistance of third-party forensic experts
Notified law enforcement
Initiated a review and analysis of those files
Secured the services of Experian to provide you with one year of complimentary identity monitoring services
Changes made: Implementing additional safeguards and technical security measures to further protect and monitor our systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 weeks(49 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings

View merged incident ↗

HHS OCRApr 24 · first

California State AGApr 24 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-601829
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 24, 2025
Raw hash: b50b431e559c610d3c04d19ec680da1ded02049e2c937953df1ab6a327daa898

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityPalo Verde Hospital

Victim entityPalo Verde Hospital

Incidentdiscovered Mar 6, 2025

Stated responseTook steps to secure our systems and contain the incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov