Methodist Hospital of Southern California data breach (2020)

Breach window

Feb 1, 2020 → May 31, 2020

When the intrusion reportedly occurred, per the linked filings

221 days

Breach discovered

Sep 9, 2020

Reported by CALIFORNIA AG filing

56 days

🐻California State AGFirst filinglinked via operator-confirmed · 100%

Filed Nov 4, 2020bd_597393eee158ef0e

Methodist Hospital of Southern California notified patients of a ransomware attack on its third-party vendor, Blackbaud Inc., affecting the hospital's donor database. The attack occurred between Feb-May 2020. Patient data including names, contact info, DOB, and medical record numbers were copied. Blackbaud paid the ransom and confirmed data destruction. MHSC reported the incident to the CA Dept of Public Health.

CA 60-day OK · 41d

CALIFORNIAHHS OCRMost recentlinked via operator-confirmed · 100%

Filed Nov 4, 2020bd_b797ec81be26bb95

Methodist Hospital of Southern California reported to HHS OCR on 2020-11-04 that its business associate experienced a ransomware attack affecting the ePHI of approximately 39,881 individuals. Breached information was located on a Network Server and included names, addresses, dates of birth, and treatment information. The breach involved the CE's medical foundation, which is not subject to HIPAA Rules.

Affected (this filing): 39,881

Methodist Hospital of Southern California

Litigation Timing

Timeline