HackingHealthcareHealthcareStolen CredentialsCustomer Data InvolvedTargetedFinancial accountHealth (basic)Identity (basic)Government IDPHIHighContained

Summit Pathology and Summit Pathology Laboratories, Inc.

bd_ef1b12b42829f23c · schema v1 · pii pii-v1

Severity

High

Discovered

Apr 18, 2024

Filed

Oct 18, 2024

To disclose

26 weeks

Affected

3,250state residents only

Linked

3 filings

Confidence

70%

Full breach record for Summit Pathology and Summit Pathology Laboratories, Inc. →

Summit Pathology & Summit Pathology Laboratories, Inc. reported unauthorized access to systems containing patient demographic, healthcare, and financial data affecting 3,250 Washington residents. The incident was discovered on April 18, 2024, and notification letters were sent on October 18, 2024. The organization engaged forensic specialists and notified law enforcement.

J jump to incidentP pin to compareR raw source

Washington clock✗ WA AG >90d26 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 26 weeks / 183 days

Apr 18, 2024

Begins

Apr 18, 2024

Discovered

Oct 18, 2024

Filed

vs. sector median

+15 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

HHS OCRbd_591e8c14c44024742024-10-18Verified
New Hampshire State AGbd_1bf99adfc1d7afcc2024-10-23 · +5dVerified

Name: Summit Pathology and Summit Pathology Laboratories, Inc.
norm: summit pathology and summit pathology laboratories

Name: Summit Pathology and Summit Pathology Laboratories, Inc.
norm: summit pathology and summit pathology laboratories
Industry: Healthcarellm

Discovered: Apr 18, 2024
Breach occurred: Apr 18, 2024
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 18, 2024
Affected individuals: 3,250state-resident count only
Data types: Identity (basic)Government IDHealth (basic)Financial account
Data elements: NameSocial Security numberDate of birthHealth insurance IDMedical information
WA-stated cause: Unauthorized Access
WA-stated duration: lifecycle 0dexposure 0d
WA-stated discovery: Found while ongoingContained same day
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: Notified law enforcement
Initial access: valid_credentials

During the incident: Took steps to secure our network
Launched an investigation with the assistance of third-party forensic specialists
Promptly notified law enforcement
Provided access to identity theft protection services through IDX
Changes made: Reviewed existing policies and procedures
Implemented additional administrative and technical safeguards
Worked with third-party subject matter specialists to further enhance the security of our systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 26 weeks(183 days from discovery to filing)
Compliance flags: WA AG >90d
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

HHS OCROct 18 · first

Washington State AGOct 18 · first · this page

New Hampshire State AG+5d

Pattern: first filing Oct 18 (CO), last Oct 23 (NH) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA31027.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 18, 2024
Raw hash: 5f4ea1be785459dcbd5216c7512e0192f9f75c6bf8331e027e2995f6d6f20eb5

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entitySummit Pathology and Summit Pathology Laboratories, Inc.

Victim entitySummit Pathology and Summit Pathology Laboratories, Inc.

Incidentdiscovered Apr 18, 2024

Stated responseTook steps to secure our network

ComplianceWA AG >90d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com