MULTICARE HEALTH SYSTEM

MultiCare Health System, Inc. reported a data breach to the Maine Attorney General, which was discovered on September 30, 2022. The breach, an external system hacking incident that occurred on May 18, 2022, affected 3 Maine residents. The compromised information included names and Social Security numbers. In response, MultiCare offered two years of Equifax credit monitoring services to the individuals affected. The notification to consumers was sent on October 25, 2022. The breach was reported by outside counsel representing a service provider involved in the incident.

MultiCare Health System, Inc. (Kaye-Smith Enterprises, Inc.), a health sector entity reported a ransomware incident to the Washington Attorney General. The organization became aware of the incident on 2022-06-02 and filed notice on 2022-07-25. 22,679 Washington residents were affected. 53 days elapsed between awareness and notification. 15 days to identify the breach. 0 days to contain the breach.

MultiCare Health System (WA) reported to HHS on 2020-08-22 a Hacking/IT Incident (ransomware attack) affecting 179,189 individuals. The attack was experienced by a business associate and impacted ePHI stored on a Network Server. Breached information included names, dates of birth, clinical information, and other treatment information. The CE notified HHS, affected individuals, the media, and provided substitute notice.

MultiCare Health System, a health sector entity reported a ransomware incident to the Washington Attorney General. The organization became aware of the incident on 2020-07-16 and filed notice on 2020-08-21. 302,769 Washington residents were affected. 36 days elapsed between awareness and notification. 160 days to identify the breach. 0 days to contain the breach.

MultiCare Health System (WA) reported to HHS OCR on 2017-01-26 a Hacking/IT Incident affecting 1,249 individuals. A phishing attack enabled a hacker to gain access to an employee's email credentials for approximately 3 days. PHI exposed included names, dates of birth, dates of service, diagnoses, medical record numbers, and descriptions of treatment. The CE updated phishing policies, implemented technical safeguards, and retrained staff. OCR provided technical assistance and obtained documented assurances of corrective action. Breached information located on Email.