MalwareHealthcareHealthcareRansomwareData ExfiltratedRansom DemandedHealth (basic)Identity (basic)Government IDPHIHighContained

Evergreen Treatment Services (ETS)

bd_efd6d70f7921f401 · schema v1 · pii pii-v1

Severity

High

Discovered

Dec 12, 2022

Filed

Feb 13, 2023

To disclose

9 weeks

Affected

11,247state residents only

Linked

4 filings

Confidence

70%

Full breach record for Evergreen Treatment Services (ETS) →

Evergreen Treatment Services (ETS) disclosed a ransomware incident affecting 11,247 individuals in Washington. The breach, discovered on Dec 12, 2022, exposed names, SSNs, DOBs, and treatment info. ETS offered 12 months of identity theft protection via IDX and strengthened network security.

J jump to incidentP pin to compareR raw source

Washington clock⏱ WA AG >30d9 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 9 weeks / 63 days

Dec 12, 2022

Begins

Dec 12, 2022

Discovered

Feb 13, 2023

Filed

vs. sector median

4 wks faster

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Indiana State AGbd_ab3965e15319702b2023-02-13Candidate
HHS OCRbd_6dbb8a022cf0b8082023-02-10 · +3dVerified
Massachusetts State AGbd_8e636e7a547ff2bc2023-02-21 · +8dVerified

Name: Evergreen Treatment Services (ETS)
norm: evergreen treatment services ets
Domain: evergreentreatment.org
Industry: Non-Profit/Charity

Name: Evergreen Treatment Services (ETS)
norm: evergreen treatment services ets
Domain: evergreentreatment.org
Industry: Non-Profit/Charity
Industry: Healthcarellm

Discovered: Dec 12, 2022
Breach occurred: Dec 12, 2022
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 13, 2023
Affected individuals: 11,247state-resident count only
Data types: Identity (basic)Government IDHealth (basic)
Data elements: NameSocial Security numberDate of birthHealth insurance IDMedical information
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 0dexposure 0d
WA-stated discovery: Found while ongoingContained same day
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified Washington Attorney General

During the incident: Offering identity theft protection services through IDX
Implemented measures to strengthen the security of our network environment
Changes made: Implemented measures to strengthen the security of our network environment
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(63 days from discovery to filing)
Compliance flags: WA AG >30d
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 3 states

View merged incident ↗

HHS OCRFeb 10 · first

Indiana State AG+3d

Washington State AG+3d · this page

Massachusetts State AG+11d

Pattern: first filing Feb 10 (WA), last Feb 21 (MA) — a 11-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA19847.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 13, 2023
Raw hash: 5aa32b00ac98ac724a33afa4cc9c71dacc1a0ae250dcbbd9b5bd152bec36cf89

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityEvergreen Treatment Services (ETS)

Victim entityEvergreen Treatment Services (ETS)

Incidentdiscovered Dec 12, 2022

Stated responseOffering identity theft protection services through IDX

ComplianceWA AG >30d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com