Social EngineeringHealthcareProfessional ServicesHealthcarePhishingStolen CredentialsCustomer Data InvolvedEmployee Data InvolvedPIIPHIIdentity (basic)Health (basic)LowContained

Capitol Administrators, Inc

bd_eaa2615eb5b27269 · schema v1 · pii pii-v1

Severity

Low

Discovered

Mar 30, 2018

Filed

May 11, 2018

To disclose

6 weeks

Affected

Not disclosed

Linked

2 filings

Confidence

65%

Full breach record for Capitol Administrators, Inc →

Capitol Administrators, Inc. reported a data breach resulting from a phishing email incident. On March 30, 2018, the company discovered that an unauthorized individual had accessed emails and attachments in a small number of employee accounts. The breach window was identified as January 7–24, 2018. Affected data included names and personal/medical information of plan participants. Capitol engaged a cybersecurity firm, secured accounts, implemented MFA, and offered one year of identity monitoring via Kroll.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 82 days

discovery → filing · 6 weeks / 42 days

Jan 7, 2018

Begins

Mar 30, 2018

Discovered

May 11, 2018

Filed

vs. sector median

6 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

HHS OCRbd_4ac3f5743079772f2018-05-11Verified by operator

Name: Capitol Administrators, Inc
norm: capitol administrators

Name: Capitol Administrators, Inc
norm: capitol administrators
Industry: HealthcarellmProfessional Servicesllm

Discovered: Mar 30, 2018
Breach occurred: Jan 7, 2018 – Jan 24, 2018
Undetected for: 82 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: PIIPHIIdentity (basic)Health (basic)
Attack vector: Phishing
MITRE ATT&CK: T1566 PhishingT1078 Valid AccountsT1114 Email Collection
Threat actor: External
Initial access: phishing_link

During the incident: Took immediate steps to secure the account
Conducted an internal investigation
Enhanced the security of its system
Engaged a leading cyber security firm to perform an investigation
Changes made: Implemented multi-factor authentication
Upgraded its security center
Providing education and training to its employees to help prevent a similar incident from happening in the future
Arranged for Kroll to provide identity monitoring at no cost to you for one year
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(42 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings

View merged incident ↗

HHS OCRMay 11 · first

California State AGMay 11 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-136119
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 11, 2018
Raw hash: 0089616e03d792e06e8e3c4d617ce9f6ba92c7884d1d6d618ce48e00f7b05a6e

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityCapitol Administrators, Inc

Victim entityCapitol Administrators, Inc

Incidentdiscovered Mar 30, 2018

Stated responseTook immediate steps to secure the account

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov