HackingHealthcareHealthcareVulnerability ExploitStolen CredentialsSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDCredentialsMediumContained

El Centro Regional Medical Center (ECRMC)

bd_f8d0afcabb7a1615 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 1, 2018

Filed

Nov 16, 2018

To disclose

15 weeks

Affected

5state residents only

Linked

3 filings

Confidence

66%

Full breach record for El Centro Regional Medical Center (ECRMC) →

El Centro Regional Medical Center (ECRMC) notified the Montana AG of a data breach involving its vendor Jobscience. An unknown actor exploited an Adobe ColdFusion vulnerability to access ECRMC job applicant data between May 8-11, 2018. ECRMC was notified in late August 2018. Data exposed included names, addresses, phone numbers, usernames, passwords, emails, and SSNs. 5 Montana residents were affected. Notifications were sent in November 2018.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 85 days

discovery → filing · 15 weeks / 107 days

May 8, 2018

Begins

Aug 1, 2018

Discovered

Nov 16, 2018

Filed

vs. sector median

+3 wks slower

This filing is one of 3 about the same incident.View merged incident

Part of JobScience supply-chain incident (2018) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_762475ae82da2c3d2018-11-20 · +4dVerified
California State AGbd_c95d3762458676012018-11-20 · +4dVerified

Name: SHEPPARD, MULLIN, RICHTER & HAMPTON LLP
norm: sheppard mullin richter hampton

Name: El Centro Regional Medical Center (ECRMC)
norm: el centro regional medical center ecrmc
Industry: Healthcarellm

Discovered: Aug 1, 2018
Breach occurred: May 8, 2018 – May 11, 2018
Undetected for: 85 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 16, 2018
Affected individuals: 5state-resident count only
Data types: Identity (basic)Government IDCredentials
Data elements: Date of birth
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 ChannelT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified Montana Office of the Attorney General
Third party: via Jobscience (Bullhorn)
Initial access: exploit_public_facing

During the incident: Worked with Jobscience to determine which job applicants were impacted
Confirmed Jobscience worked with the Federal Bureau of Investigation (FBI) and a service provider to investigate
Sent notification to impacted individuals via USPS and/or email
Setup a dedicated call center with bilingual agents to answer questions
Changes made: Jobscience contained the incident
Ended the third party's access to their system
Remediated the issues that led to the compromise
Provided 24 months of complimentary credit monitoring
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 15 weeks(107 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Montana State AGNov 16 · first · this page

Massachusetts State AG+4d

California State AG+4d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/El-Centro-Regional-Medical-Center-ECRMC.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 16, 2018
Raw hash: 8a2b2dabf2dfbdbcc71904b029ec5258b88f61168e2235af0d7e1400ba369b9e

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entitySHEPPARD, MULLIN, RICHTER & HAMPTON LLP

Victim entityEl Centro Regional Medical Center (ECRMC)

Incidentdiscovered Aug 1, 2018

Stated responseWorked with Jobscience to determine which job applicants were impacted

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov