Social EngineeringHealthcareHealthcarePhishingStolen CredentialsCustomer Data InvolvedEmployee Data InvolvedPHIIdentity (basic)Government IDHealth (basic)Financial accountMediumContained

UnityPoint Health

bd_fb9da4101eacad04 · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 31, 2018

Filed

Jul 30, 2018

To disclose

9 weeks

Affected

Not disclosed

Linked

6 filings

Confidence

65%

Full breach record for UnityPoint Health →14 incidents on file

UnityPoint Health disclosed a phishing attack that compromised employee email accounts between March 14 and April 3, 2018. The incident was discovered on May 31, 2018. Attackers used fraudulent emails to trick employees into providing credentials, gaining access to protected health information and personal data including SSNs and financial account numbers. The attack was financially motivated, likely aimed at diverting funds, though patient data was exposed. UnityPoint reset passwords, implemented MFA, and offered credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 78 days

discovery → filing · 9 weeks / 60 days

Mar 14, 2018

Begins

May 31, 2018

Discovered

Jul 30, 2018

Filed

vs. sector median

2 wks faster

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Massachusetts State AGbd_001ef817a39f7b6d2018-07-30Verified
Montana State AGbd_38c797e4e7408ca32018-07-30Verified
HHS OCRbd_799993f34d0de7d62018-07-30Verified
New Hampshire State AGbd_911dab7665ebb5b62018-07-30Verified

Show 1 more filing ↓

Montana State AGbd_f8f71ff026792fff2018-07-30Verified

Name: UnityPoint Health
norm: unitypoint health
Domain: unitypoint.org

Name: UnityPoint Health
norm: unitypoint health
Domain: unitypoint.org
Industry: Healthcarellm

Discovered: May 31, 2018
Breach occurred: Mar 14, 2018 – Apr 3, 2018
Undetected for: 78 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: PHIIdentity (basic)Government IDHealth (basic)Financial account
Data elements: Social Security numberDate of birthMedical information
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Regulator citations: Informed law enforcement agencies
Initial access: phishing_link

During the incident: Launched an investigation with an expert computer forensics firm
Informed law enforcement agencies
Reset passwords for all compromised accounts
Conducted mandatory education for employees to recognize and avoid phishing emails
Added technology to identify suspicious external emails
Implemented multi-factor authentication
Offered free one-year credit monitoring through Experian IdentityWorks
Changes made: Conducted mandatory education for employees to recognize and avoid phishing emails
Added technology to identify suspicious external emails
Implemented multi-factor authentication
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(60 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 5 states

View merged incident ↗

Massachusetts State AGJul 30 · first

Montana State AGJul 30 · first

HHS OCRJul 30 · first

New Hampshire State AGJul 30 · first

Montana State AGJul 30 · first

California State AGJul 30 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-138399
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 30, 2018
Raw hash: f0c08c3c8839329c56284c779ae3a2506e0b72dce0591bb1bad5d5a1400e640f

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityUnityPoint Health

Victim entityUnityPoint Health

Incidentdiscovered May 31, 2018

Stated responseLaunched an investigation with an expert computer forensics firm

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov