Social EngineeringHealthcareHealthcarePhishingCustomer Data InvolvedPHIPIILowContained

GHR

bd_ff88c330c28711de · schema v1 · pii pii-v1

Severity

Low

Discovered

Nov 13, 2020

Filed

Mar 9, 2021

To disclose

17 weeks

Affected

1state residents only

Confidence

66%

GHR notified Montana residents of a data security incident occurring on November 13, 2020, involving unauthorized access to an email account containing PHI and PII. GHR engaged cybersecurity experts and offered IDX credit monitoring services. No evidence of misuse was found at the time of notification.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 17 weeks / 116 days

Nov 13, 2020

Begins

Nov 13, 2020

Discovered

Mar 9, 2021

Filed

vs. sector median

+4 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1 affectedView incident

Name: Garrett Hemann Robertson
norm: garrett hemann robertson

Name: GHR
norm: ghr
Industry: Healthcarellm

Discovered: Nov 13, 2020
Breach occurred: Nov 13, 2020
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 4, 2021
Affected individuals: 1state-resident count only
Data types: PHIPII
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing Link
Threat actor: External
Initial access: phishing_link

During the incident: Engaged a team of cybersecurity experts
Offering complementary credit monitoring and identity monitoring services
Offering identity theft protection services through IDX
Changes made: Taken further steps to minimize the risks of a similar event from happening again
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 17 weeks(116 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/ghrSamp.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 9, 2021
Raw hash: 19660554a2ad7b6b354c1d841cdb38167d9a06f6171857a483849148cf31cc49

Reporting entityGarrett Hemann Robertson

Victim entityGHR

Incidentdiscovered Nov 13, 2020

Stated responseEngaged a team of cybersecurity experts

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov