HackingHealthcareHealthcareStolen CredentialsCustomer Data InvolvedEmployee Data InvolvedPHIHealth (basic)Identity (basic)LowContained

Salinas Valley Memorial Healthcare System

bd_f3a47a46665d2ac7 · schema v1 · pii pii-v1

Severity

Low

Discovered

Apr 30, 2020

Filed

Jun 29, 2020

To disclose

9 weeks

Affected

Not disclosed

Linked

3 filings

Confidence

65%

Full breach record for Salinas Valley Memorial Healthcare System →

Salinas Valley Memorial Healthcare System (SVMHS) experienced a cyber incident where five email accounts (one employee, one contractor, three employees) were compromised via Outlook Web Access. The breach was discovered on April 30, 2020, with the occurrence date listed as April 29, 2020. Affected data included PHI such as names, medical record numbers, service locations, and attending physician information. SVMHS disabled access, reset passwords, implemented MFA, and offered one year of Experian IdentityWorks. No evidence suggests data was viewed or copied.

J jump to incidentP pin to compareR raw source

California clockDiscovered Apr 30, 2020 → Notified Jun 29, 202060d ✓ CA 60-day OK9 weeks discovery → filing

Incident timeline

undetected · 1 days

discovery → filing · 9 weeks / 60 days

Apr 29, 2020

Begins

Apr 30, 2020

Discovered

Jun 29, 2020

Filed

vs. sector median

2 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

HHS OCRbd_1ec6334de7840e172020-06-29Verified
California State AGbd_365713df4ac39cb22020-07-29 · +30dCandidate

Name: Salinas Valley Memorial Healthcare System
norm: salinas valley memorial healthcare system

Name: Salinas Valley Memorial Healthcare System
norm: salinas valley memorial healthcare system
Industry: Healthcarellm

Discovered: Apr 30, 2020
Breach occurred: Apr 29, 2020
Undetected for: 1 dayoccurrence → discovery
Materiality determined: —
Notification sent: Jun 29, 2020
Affected individuals: Not disclosed
Data types: PHIHealth (basic)Identity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: External
Regulator citations: Notified the California Department of Public HealthNotifying the California Attorney GeneralNotifying the U.S. Department of Health and Human Services Office for Civil Rights
Initial access: valid_credentials

During the incident: Disabled access to the affected email accounts
Reset the passwords to the affected email accounts
Implemented two-factor authentication to Outlook Web Access for all SVMHS email accounts
Notified the California Department of Public Health
Notifying the California Attorney General
Notifying the U.S. Department of Health and Human Services Office for Civil Rights
Partnering with Experian to provide its Experian IdentityWorks product for one year at no charge
Changes made: Implemented additional security measures such as two-factor authentication to Outlook Web Access for all SVMHS email accounts
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(60 days from discovery to filing)
Compliance flags: CA 60-day OK · 60d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Apr 30, 2020
→ Notified: Jun 29, 2020
60d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Apr 30, 2020 → Notified: Jun 29, 2020	60d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings

View merged incident ↗

HHS OCRJun 29 · first

California State AGJun 29 · first · this page

California State AG+30d

Pattern: first filing Jun 29 (CA), last Jul 29 (CA) — a 30-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-191525
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 29, 2020
Raw hash: c5a881702ddff3ea6405b21ba9f86654aa4297783177035e3b49181992726c0a

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entitySalinas Valley Memorial Healthcare System

Victim entitySalinas Valley Memorial Healthcare System

Incidentdiscovered Apr 30, 2020

Stated responseDisabled access to the affected email accounts

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov