HackingSupply Chain (3P Vendor)Customer Data InvolvedPHIIDENTITY_GOVERNMENTIDENTITY_BASICHEALTH_BASICMediumContained
Providence St. Joseph Health Investment Trust
bd_f7ae7b366f36a6b4 · schema v1 · pii pii-v1
Full breach record for Providence St. Joseph Health Investment Trust →Providence St. Joseph Health notified patients that MCG Health, LLC, a third-party vendor, experienced a breach on March 25, 2022. An electronic file containing patient names, SSNs, medical codes, addresses, phone numbers, DOBs, and genders was accessed by an unauthorized source. MCG engaged forensics and law enforcement. Providence offered 12 months of identity protection via IDX.
California clockDiscovered Mar 25, 2022 → Notified Jun 27, 202294d ✗ CA 60-day late14 weeks discovery → filing
Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-554687
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jun 28, 2022
- Raw hash
- 04a29f6d21d5d750f5235cef56a0ec66cf40aec2459ac5f11d58acccdfe2be95
Reporting entity
- Name
- MCG Health, LLCnorm: mcg health
- Domain
- mcg.com
Victim entity
- Name
- Providence St. Joseph Health Investment Trustnorm: providence st joseph health investment
Incident
- Discovered
- Mar 25, 2022
- Materiality determined
- —
- Notification sent
- Jun 27, 2022
- Affected individuals
- Not disclosed
- Data types
- PHIIDENTITY_GOVERNMENTIDENTITY_BASICHEALTH_BASIC
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1195 Supply Chain Compromise
- Threat actor
- External
- Third party
- via MCG Health, LLC
- Initial access
- supply_chain
Compliance
- Time to disclose
- 14 weeks(95 days from discovery to filing)
- Compliance flags
- CA 60-day late · 94d
- Discovery-date grounding
- letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Mar 25, 2022→ Notified: Jun 27, 202294d 60 days (analyst band, pre-2026 discoveries) CA 60-day late
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.