Incident Types: The types of cybersecurity incidents that have occurred include Ransomware and Breach.

Detection and Response: The company detects and responds to cybersecurity incidents through an remediation measures with free credit and identity theft protection-monitoring services, and communication strategy with notified affected patients, and recovery measures with transparency, recovery measures with reconnection of supplies, and communication strategy with transparency, and communication strategy with notifications to affected individuals..

Common Attack Types: The most common types of attacks the company has faced is Ransomware.

Identification of Attack Vectors: The company identifies the attack vectors used in incidents through Social Engineering and phishing link clicked via Microsoft Bing/Edge on contractor’s laptop.

Commonly Compromised Data Types: The types of data most commonly compromised in incidents are Personally Identifiable Information, Health Information, , Personal Information, , Personal Health Information, Personal Information, , Personal Data, Medical Records, Payment Information, Insurance Details, Government Ids, , Personally Identifiable Information (Pii), Protected Health Information (Phi) and .

Prevention of Data Exfiltration: The company takes the following measures to prevent data exfiltration: Free credit and identity theft protection-monitoring services, .

Data Recovery from Ransomware: The company recovers data encrypted by ransomware through Transparency, Reconnection of supplies, .

Ensuring Regulatory Compliance: The company ensures compliance with regulatory requirements through Sen. Ron Wyden's call for FTC investigation into Microsoft's default security configurations, .

Key Lessons Learned: The key lessons learned from past incidents are Default configurations in enterprise software (e.g., Microsoft Active Directory) can enable large-scale breaches if outdated protocols (e.g., RC4) are retained.,Kerberoasting exploits persist due to legacy encryption support, despite decades of warnings.,Organizations rarely modify default security settings, placing burden on vendors to enforce secure defaults.,Phishing remains a critical initial access vector, especially via default applications (e.g., Microsoft Edge/Bing).

Additional Resources: Stakeholders can find additional resources on cybersecurity best practices at and Source: CyberScoop, and Source: Sen. Ron Wyden’s letter to FTC Chair Andrew Ferguson, and Source: CISA, FBI, NSA joint advisory (2023–2024) on RC4/Kerberoasting, and Source: Washington State Office of the Attorney GeneralDate Accessed: 2024-12-19.

Communication of Investigation Status: The company communicates the status of incident investigations to stakeholders through Notified Affected Patients, Transparency and Notifications To Affected Individuals.

Advisories Provided: The company provides the following advisories to stakeholders and customers following an incident: were Notifications To Affected Individuals, and Sen. Wyden’S Oversight Findings Shared With Ascension And Microsoft.

Corrective Actions Taken: The company has taken the following corrective actions based on post-incident analysis: Microsoft’S Planned Deprecation Of Rc4 (Q1 2026 For Active Directory)., Ascension Likely Implemented Stricter Password Policies And Active Directory Monitoring Post-Breach., .

Last Attacking Group: The attacking group in the last incident were an Unauthorized Individual and Clop ransomware group.

Most Recent Incident Detected: The most recent incident detected was on 2021-09-08.

Most Recent Incident Publicly Disclosed: The most recent incident publicly disclosed was on 2024-12-19.

Most Significant Data Compromised: The most significant data compromised in an incident were full name, date of birth, address(es), email address(es), phone number(s), health insurance information, health insurance identification number, medical records, Social Security numbers, , Personal Information, , Personal health information, Physician names, Admission and discharge dates, Diagnosis and billing codes, Medical record numbers, Insurance company names, Names, Addresses, Phone numbers, Email addresses, Dates of birth, Race, Gender, Social Security numbers, , personal data, medical records, payment information, insurance information, government IDs, , social security numbers, medical information and .

Most Significant System Affected: The most significant system affected in an incident was Electronic Health Record and and Electronic Health Records (EHR)Other Clinical Systems and .

Most Sensitive Data Compromised: The most sensitive data compromised in a breach were Social Security numbers, Phone numbers, personal data, payment information, health insurance information, Medical record numbers, Addresses, Names, Admission and discharge dates, Email addresses, Gender, insurance information, Physician names, Personal health information, Dates of birth, social security numbers, health insurance identification number, Personal Information, full name, address(es), email address(es), Diagnosis and billing codes, medical information, Insurance company names, phone number(s), date of birth, government IDs, medical records and Race.

Number of Records Exposed in Most Significant Breach: The number of records exposed in the most significant breach was 5.6M.

Most Significant Legal Action: The most significant legal action taken for a regulatory violation was Sen. Ron Wyden's call for FTC investigation into Microsoft's default security configurations, .

Most Significant Lesson Learned: The most significant lesson learned from past incidents was Phishing remains a critical initial access vector, especially via default applications (e.g., Microsoft Edge/Bing).

Most Significant Recommendation Implemented: The most significant recommendation implemented to improve cybersecurity was Healthcare sector should prioritize patching Active Directory vulnerabilities and monitoring for Kerberoasting., Public disclosure of timelines for security fixes should be accelerated to reduce exposure windows., Vendors must proactively deprecate obsolete encryption standards, even if it risks breaking legacy systems., Enforce stronger default password policies for privileged accounts (e.g., 14+ characters). and Microsoft should disable RC4 by default immediately (planned for Q1 2026 is insufficient)..

Most Recent Source: The most recent source of information about an incident are CyberScoop, Sen. Ron Wyden’s letter to FTC Chair Andrew Ferguson, Washington State Office of the Attorney General, CISA, FBI and NSA joint advisory (2023–2024) on RC4/Kerberoasting.

Current Status of Most Recent Investigation: The current status of the most recent investigation is ongoing (FTC investigation requested by Sen. Wyden).

Most Recent Stakeholder Advisory: The most recent stakeholder advisory issued was Sen. Wyden’s oversight findings shared with Ascension and Microsoft, .

Most Recent Customer Advisory: The most recent customer advisory issued was an Notifications to affected individuals.

Most Recent Entry Point: The most recent entry point used by an initial access broker were an phishing link clicked via Microsoft Bing/Edge on contractor’s laptop and Social Engineering.

Most Significant Root Cause: The most significant root cause identified in post-incident analysis was Human Error, Use of obsolete RC4 encryption in Active Directory (enabled by default).Default weak password policies for privileged accounts.Phishing attack via default Microsoft applications (Edge/Bing).Lack of network segmentation allowing lateral movement to thousands of systems..

Most Significant Corrective Action: The most significant corrective action taken based on post-incident analysis was Microsoft’s planned deprecation of RC4 (Q1 2026 for Active Directory).Ascension likely implemented stricter password policies and Active Directory monitoring post-breach..