Sutter Health data breach (2023)

Breach window

May 30, 2023 → May 31, 2023

When the intrusion reportedly occurred, per the linked filings

57 days

Breach discoveredletter-grounded

Jul 26, 2023

Reported by CALIFORNIA AG filing

100 days

🐻California State AGFirst filinglinked via same-victim cross-source · 100%

Filed Nov 3, 2023bd_8f504197ab096f70

Sutter Health notified patients of a data breach involving its third-party vendor, Welltok, Inc. An unknown actor exploited software vulnerabilities in Welltok's MOVEit Transfer server on May 30-31, 2023, exfiltrating data including names and other personal information. Welltok was alerted on July 26, 2023, and confirmed the compromise on August 11, 2023. Affected individuals are offered credit monitoring and identity restoration services.

CALIFORNIAHHS OCRMost recentlinked via same-victim cross-source · 100%

Filed Nov 3, 2023bd_af3fc728ff443e64

Sutter Health reported to HHS on 2023-11-03 a Hacking/IT Incident affecting 845,441 individuals. Breached information located on Network Server. A business associate experienced a malware attack affecting PHI including names, addresses, DOB, and diagnoses. CE provided credit monitoring and implemented safeguards.

Affected (this filing): 845,441

SUTTER HEALTH

Litigation Timing

Sensitive data

Timeline