Incident Types: The types of cybersecurity incidents that have occurred include Breach, Ransomware and Cyber Attack.

Total Financial Loss: The total financial loss from these incidents is estimated to be $240 thousand.

Detection and Response: The company detects and responds to cybersecurity incidents through an remediation measures with free credit and identity theft protection-monitoring services, and communication strategy with notified affected patients, and recovery measures with transparency, recovery measures with reconnection of supplies, and communication strategy with transparency, and communication strategy with notifications to affected individuals..

Common Attack Types: The most common types of attacks the company has faced is Ransomware.

Identification of Attack Vectors: The company identifies the attack vectors used in incidents through Social Engineering and phishing link clicked via Microsoft Bing/Edge on contractor’s laptop.

Average Financial Loss: The average financial loss per incident is $21.82 thousand.

Commonly Compromised Data Types: The types of data most commonly compromised in incidents are Personally Identifiable Information, Health Information, , Personal Information, , Patient personal information, ePHI, Personal Health Information, Personal Information, , Names, Medical Information, Payment Information, Insurance Information, Government Identification, Other Personal Information, , Medical, Payment, Insurance, Government Identification, , Personal Data, Medical Records, Payment Information, Insurance Details, Government Ids, , Personally Identifiable Information (Pii), Protected Health Information (Phi), and Personal Information.

Prevention of Data Exfiltration: The company takes the following measures to prevent data exfiltration: Free credit and identity theft protection-monitoring services, .

Data Recovery from Ransomware: The company recovers data encrypted by ransomware through Transparency, Reconnection of supplies, .

Ensuring Regulatory Compliance: The company ensures compliance with regulatory requirements through Class action lawsuits, Sen. Ron Wyden's call for FTC investigation into Microsoft's default security configurations, , Proposed class action lawsuit (negligence, negligence per se, consumer protection violations).

Key Lessons Learned: The key lessons learned from past incidents are Default configurations in enterprise software (e.g., Microsoft Active Directory) can enable large-scale breaches if outdated protocols (e.g., RC4) are retained.,Kerberoasting exploits persist due to legacy encryption support, despite decades of warnings.,Organizations rarely modify default security settings, placing burden on vendors to enforce secure defaults.,Phishing remains a critical initial access vector, especially via default applications (e.g., Microsoft Edge/Bing).

Additional Resources: Stakeholders can find additional resources on cybersecurity best practices at and Source: California Attorney General's Office, and Source: Maine Office of the Attorney GeneralDate Accessed: 2024-12-19, and Source: CyberScoop, and Source: Sen. Ron Wyden’s letter to FTC Chair Andrew Ferguson, and Source: CISA, FBI, NSA joint advisory (2023–2024) on RC4/Kerberoasting, and Source: Washington State Office of the Attorney GeneralDate Accessed: 2024-12-19, and Source: US District Court for the Eastern District of Missouri (Judge John A. Ross ruling).

Communication of Investigation Status: The company communicates the status of incident investigations to stakeholders through Notified Affected Patients, Transparency and Notifications To Affected Individuals.

Advisories Provided: The company provides the following advisories to stakeholders and customers following an incident: were Notifications To Affected Individuals, and Sen. Wyden’S Oversight Findings Shared With Ascension And Microsoft.

Corrective Actions Taken: The company has taken the following corrective actions based on post-incident analysis: Microsoft’S Planned Deprecation Of Rc4 (Q1 2026 For Active Directory)., Ascension Likely Implemented Stricter Password Policies And Active Directory Monitoring Post-Breach., .

Last Attacking Group: The attacking group in the last incident were an Unauthorized Individual, Black Basta and Clop ransomware group.

Most Recent Incident Detected: The most recent incident detected was on 2021-09-08.

Most Recent Incident Publicly Disclosed: The most recent incident publicly disclosed was on 2024-12-19.

Highest Financial Loss: The highest financial loss from an incident was $240,000.

Most Significant Data Compromised: The most significant data compromised in an incident were full name, date of birth, address(es), email address(es), phone number(s), health insurance information, health insurance identification number, medical records, Social Security numbers, , Personal Information, , Patient personal information, ePHI, Personal health information, Physician names, Admission and discharge dates, Diagnosis and billing codes, Medical record numbers, Insurance company names, Names, Addresses, Phone numbers, Email addresses, Dates of birth, Race, Gender, Social Security numbers, , names, medical information, payment information, insurance information, government identification, other personal information, , Medical Information, Payment Information, Insurance Information, Government Identification Information, , personal data, medical records, payment information, insurance information, government IDs, , social security numbers, medical information, , Personal Information and .

Most Significant System Affected: The most significant system affected in an incident was Electronic Health Record and and Electronic Health Records (EHR)Other Clinical Systems and Electronic health records systemEmergency medical services and .

Most Sensitive Data Compromised: The most sensitive data compromised in a breach were Payment Information, Patient personal information, Insurance Information, Government Identification Information, ePHI, Gender, address(es), email address(es), medical information, Insurance company names, Personal health information, Physician names, Email addresses, phone number(s), Admission and discharge dates, Race, names, government IDs, health insurance identification number, Medical record numbers, Names, Dates of birth, full name, Medical Information, Social Security numbers, payment information, social security numbers, other personal information, personal data, insurance information, Phone numbers, government identification, Diagnosis and billing codes, date of birth, Addresses, Personal Information, medical records and health insurance information.

Number of Records Exposed in Most Significant Breach: The number of records exposed in the most significant breach was 16.3M.

Highest Fine Imposed: The highest fine imposed for a regulatory violation was $240,000.

Most Significant Legal Action: The most significant legal action taken for a regulatory violation was Class action lawsuits, Sen. Ron Wyden's call for FTC investigation into Microsoft's default security configurations, , Proposed class action lawsuit (negligence, negligence per se, consumer protection violations).

Most Significant Lesson Learned: The most significant lesson learned from past incidents was Phishing remains a critical initial access vector, especially via default applications (e.g., Microsoft Edge/Bing).

Most Significant Recommendation Implemented: The most significant recommendation implemented to improve cybersecurity was Enforce stronger default password policies for privileged accounts (e.g., 14+ characters)., Public disclosure of timelines for security fixes should be accelerated to reduce exposure windows., Microsoft should disable RC4 by default immediately (planned for Q1 2026 is insufficient)., Healthcare sector should prioritize patching Active Directory vulnerabilities and monitoring for Kerberoasting., Vendors must proactively deprecate obsolete encryption standards and even if it risks breaking legacy systems..

Most Recent Source: The most recent source of information about an incident are Maine Office of the Attorney General, CyberScoop, US District Court for the Eastern District of Missouri (Judge John A. Ross ruling), Sen. Ron Wyden’s letter to FTC Chair Andrew Ferguson, Washington State Office of the Attorney General, CISA, FBI, NSA joint advisory (2023–2024) on RC4/Kerberoasting and California Attorney General's Office.

Current Status of Most Recent Investigation: The current status of the most recent investigation is ongoing (FTC investigation requested by Sen. Wyden).

Most Recent Stakeholder Advisory: The most recent stakeholder advisory issued was Sen. Wyden’s oversight findings shared with Ascension and Microsoft, .

Most Recent Customer Advisory: The most recent customer advisory issued was an Notifications to affected individuals.

Most Recent Entry Point: The most recent entry point used by an initial access broker were an phishing link clicked via Microsoft Bing/Edge on contractor’s laptop and Social Engineering.

Most Significant Root Cause: The most significant root cause identified in post-incident analysis was Human Error, Use of obsolete RC4 encryption in Active Directory (enabled by default).Default weak password policies for privileged accounts.Phishing attack via default Microsoft applications (Edge/Bing).Lack of network segmentation allowing lateral movement to thousands of systems..

Most Significant Corrective Action: The most significant corrective action taken based on post-incident analysis was Microsoft’s planned deprecation of RC4 (Q1 2026 for Active Directory).Ascension likely implemented stricter password policies and Active Directory monitoring post-breach..