HackingHealthcareHealthcareStolen CredentialsSupply Chain (3P Vendor)Customer Data InvolvedDelayed DiscoveryPHIIdentity (basic)Government IDHealth (basic)Financial accountMediumContained

Keck Medicine of USC

bd_fa3e3127616abfc8 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 14, 2022

Filed

Sep 30, 2022

To disclose

24 weeks

Affected

Not disclosed

Linked

4 filings

Confidence

65%

Full breach record for Keck Medicine of USC →2 incidents on file

An unauthorized third party accessed a Microsoft Office 365 business email account at Conifer Revenue Cycle Solutions, a vendor for Keck Medicine of USC. Access occurred on Jan 20, 2022, and was discovered on Apr 14, 2022. Affected data may include PHI, PII, SSNs, and financial info for Keck patients. Conifer engaged forensics, reset credentials, and implemented MFA.

J jump to incidentP pin to compareR raw source

California clockDiscovered Apr 14, 2022 → Notified Sep 30, 2022169d ✗ CA 60-day late24 weeks discovery → filing

Incident timeline

undetected · 84 days

discovery → filing · 24 weeks / 169 days

Jan 20, 2022

Begins

Apr 14, 2022

Discovered

Sep 30, 2022

Filed

vs. sector median

+12 wks slower

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Montana State AGbd_8c5b6f345281b7b92022-09-30Candidate
Massachusetts State AGbd_c9a09807bc475d4a2022-09-30Verified
HHS OCRbd_845e68edb765044c2022-11-29 · +60dCandidate

Name: Keck Medicine of USC
norm: keck medicine of usc
Domain: keckmedicine.org

Name: Keck Medicine of USC
norm: keck medicine of usc
Domain: keckmedicine.org
Industry: Healthcarellm

Discovered: Apr 14, 2022
Breach occurred: Jan 20, 2022
Undetected for: 84 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 30, 2022
Affected individuals: Not disclosed
Data types: PHIIdentity (basic)Government IDHealth (basic)Financial account
Data elements: Social Security numberDate of birthMedical information
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: External
Third party: via Conifer Revenue Cycle Solutions, LLC
Initial access: valid_credentials

During the incident: Engaged a leading security firm
Blocked malicious IP addresses and URLs
Reset the password for the impacted account
Changes made: Enhanced security controls and monitoring practices
Accelerated implementation of multi-factor authentication for business email accounts
Offering identity theft protection services through IDX
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 24 weeks(169 days from discovery to filing)
Compliance flags: CA 60-day late · 169d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Apr 14, 2022
→ Notified: Sep 30, 2022
169d 60 days (analyst band, pre-2026 discoveries) CA 60-day late

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Apr 14, 2022 → Notified: Sep 30, 2022	169d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 3 states

View merged incident ↗

Montana State AGSep 30 · first

Massachusetts State AGSep 30 · first

California State AGSep 30 · first · this page

HHS OCR+60d

Pattern: first filing Sep 30 (MT), last Nov 29 (CA) — a 60-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-557818
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 30, 2022
Raw hash: 9aded215c2be88e2f64ae78fcc8996286f03ac0991c500c50a75af8abad22206

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityKeck Medicine of USC

Victim entityKeck Medicine of USC

Incidentdiscovered Apr 14, 2022

Stated responseEngaged a leading security firm

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov