Social EngineeringHealthcareHealthcarePhishingData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDFinancial accountHealth (basic)PHIHighContained

Southwest Washington Regional Surgery Center, LLC

bd_f56b0053b5986d62 · schema v1 · pii pii-v1

Severity

High

Discovered

Sep 25, 2018

Filed

Nov 6, 2018

To disclose

6 weeks

Affected

1,690state residents only

Linked

3 filings

Confidence

71%

Full breach record for Southwest Washington Regional Surgery Center, LLC →

Southwest Washington Regional Surgery Center, LLC reported a phishing attack compromising an employee email account between May 27 and August 13, 2018. The incident exposed PHI and PII (SSN, DL, credit card) of 1,690 Washington residents. Discovered Sept 25, 2018. Notices sent Nov 6, 2018. Remediation included password updates and enhanced email protocols.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 121 days

discovery → filing · 6 weeks / 42 days

May 27, 2018

Begins

Sep 25, 2018

Discovered

Nov 6, 2018

Filed

vs. sector median

5 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

HHS OCRbd_023228f9f0bec4602018-11-06Verified
Oregon State AGbd_b035704a1c9ca9342018-11-06Verified

Name: MCDONALD HOPKINS LLC
norm: mcdonald hopkins

Name: Southwest Washington Regional Surgery Center, LLC
norm: southwest washington regional surgery center
Industry: Healthcarellm

Discovered: Sep 25, 2018
Breach occurred: May 27, 2018 – Aug 13, 2018
Undetected for: 121 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 6, 2018
Affected individuals: 1,690state-resident count only
Data types: Identity (basic)Government IDFinancial accountHealth (basic)PHI
Data elements: NameSocial Security numberDriver's licence numberFinancial account numberDate of birthHealth insurance IDMedical information
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 100-199dexposure 1-99d
WA-stated discovery: Found after the fact
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Regulator citations: Notified Office of Washington Attorney General Consumer Protection Division
Initial access: phishing_link

During the incident: Commenced a prompt and thorough investigation
Working very closely with external data privacy and cybersecurity professionals
Conducted an extensive forensic investigation and manual email review
Provided written notice to affected residents commencing on November 6, 2018
Offered a one year of complimentary credit monitoring service to affected residents
Advised affected residents to remain vigilant in reviewing financial account statements
Advised affected residents about the process for placing a fraud alert and/or security freeze on their credit files
Provided steps to protect health information to impacted individuals
Changes made: Updating passwords
Enhancing email access protocols
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(42 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 2 states

View merged incident ↗

HHS OCRNov 6 · first

Oregon State AGNov 6 · first

Washington State AGNov 6 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10588.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 6, 2018
Raw hash: c8aa22b3bb2ee2717bacacff860865d6c77b103a4c712ee87c504664fbe014a8

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityMCDONALD HOPKINS LLC

Victim entitySouthwest Washington Regional Surgery Center, LLC

Incidentdiscovered Sep 25, 2018

Stated responseCommenced a prompt and thorough investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com