HackingHealthcareHealthcareStolen CredentialsTargetedIdentity (basic)LowContained

Forward, The National Databank for Rheumatic Diseases

bd_009089fe50437da3 · schema v1 · pii pii-v1

Severity

Low

Discovered

Mar 1, 2025

Filed

Jul 22, 2025

To disclose

20 weeks

Affected

Not disclosed

Linked

7 filings

Confidence

66%

Full breach record for Forward, The National Databank for Rheumatic Diseases →

Forward, The National Databank for Rheumatic Diseases notified consumers of unauthorized network access between March 17-22, 2025. Suspicious activity was detected in March 2025. Affected data likely included names. The organization engaged third-party cybersecurity specialists, secured its environment, and provided 24 months of free credit monitoring services.

J jump to incidentP pin to compareR raw source

Vermont clock✗ VT AG >45 bday20 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

Mar 17, 2025

Begins

Jul 22, 2025

Filed

vs. sector median

+8 wks slower

This filing is one of 7 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

Nebraska State AGbd_1695e939b1f879a52025-07-22Verified
Massachusetts State AGbd_5988433ea719cc752025-07-22Verified
Nebraska State AGbd_a24c2fe88bbad9ec2025-07-22Verified
Indiana State AGbd_be901a955d21e7502025-07-22Verified

Show 2 more filings ↓

New Hampshire State AGbd_bf1fa1bdda078a662025-07-22Verified
Maine State AGbd_dee6aa8ce0cbab6b2025-07-22Candidate

Name: Forward, The National Databank for Rheumatic Diseases
norm: forward the national databank for rheumatic diseases

Name: Forward, The National Databank for Rheumatic Diseases
norm: forward the national databank for rheumatic diseases
Industry: Healthcarellm

Discovered: Mar 1, 2025
Breach occurred: Mar 17, 2025 – Mar 22, 2025
Materiality determined: —
Notification sent: Jul 22, 2025
Affected individuals: Not disclosed
Data types: Identity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Initial access: valid_credentials

During the incident: Took steps to secure our environment
Launched a comprehensive investigation with the assistance of third-party cybersecurity specialists
Conducted a thorough review of the files
Implemented additional cybersecurity measures
Reviewed existing security policies
Providing you with access to Single Bureau Credit Monitoring/Single Bureau Credit Report/Single Bureau Credit Score services at no charge
Changes made: Implemented additional cybersecurity measures
Reviewed existing security policies to further protect against similar events moving forward
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 20 weeks(143 days from discovery to filing)
Compliance flags: VT AG >45 bday
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 6 states

View merged incident ↗

Nebraska State AGJul 22 · first

Massachusetts State AGJul 22 · first

Nebraska State AGJul 22 · first

Indiana State AGJul 22 · first

New Hampshire State AGJul 22 · first

Maine State AGJul 22 · first

Vermont State AGJul 22 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ago.vermont.gov/document/2025-07-22-forward-national-databank-rheumatic-diseases-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 22, 2025
Raw hash: 4d7de58c6709c7f427ccebeac4677ec4d0a74794ebf4f2603e0453c4440206cc

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityForward, The National Databank for Rheumatic Diseases

Victim entityForward, The National Databank for Rheumatic Diseases

Incidentdiscovered Mar 1, 2025

Stated responseTook steps to secure our environment

ComplianceVT AG >45 bday

Extraction provenanceno artifact recorded

Source provenanceago.vermont.gov