Cyber Incident Victim: Chelan Douglas Health District
Date:
Jul 2021
Location:
United States of America
Summary
The Chelan Douglas Health District experienced unauthorized system access potentially compromising identifiable personal and health information, including full names combined with Social Security numbers, dates of birth or death, financial account details, medical records, and health insurance data. The district's cybersecurity review concluded after approximately six to seven months, though regulatory standards typically require breach notifications within 60 days of discovery. Officials did not disclose the incident's ransomware status, confirmation of data encryption, or the number of affected individuals, and the event had not yet appeared on federal breach reports or ransomware leak sites at the time of reporting. Their public notice emphasized notification was issued out of caution, despite legal obligations mandating such disclosures.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
The Chelan Douglas Health District in Washington experienced a cybersecurity incident in early July 2021 that compromised identifiable personal and health information. Cybersecurity consultants concluded their investigation into the breach on February 12, 2022, with the health district publishing a public notification statement on its website approximately seven months after the intrusion occurred. The district did not disclose when it initially detected or confirmed the breach, leaving the timeline for mandatory reporting under HIPAA unclear. Exfiltrated data included individuals' full names combined with at least one additional sensitive identifier: Social Security numbers, dates of birth or death, financial account details, medical treatment or diagnosis information, patient record numbers, or health insurance policy information.
The health district declined to specify how many individuals were affected when questioned by media, and the incident had not yet appeared on federal breach reports at the time of initial disclosure. Their public notice characterized the disclosure as being made in an "abundance of caution," though critics contended this framing misleadingly implied notification was discretionary rather than legally required under HIPAA. The district's spokesperson asserted a six-to-seven-month investigation period represented accelerated progress compared to purported industry norms of two to three years. No evidence emerged linking the incident to ransomware groups, as no related postings appeared on ransomware leak sites. The breach notification omitted details about whether attacker activity included data encryption or specific system access methods. Impacted parties received unspecified guidance about protective measures while awaiting potential clarification of the incident's scope through future regulatory filings.