DisclosureLens
MalwareHealthcareHealthcareRansomwareCL0PData ExfiltratedData EncryptedCustomer Data InvolvedSupply Chain (3P Vendor)TargetedIdentity (basic)Government IDHealth (basic)PHIMediumContained

CareSource

bd_023953673f35b827 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 27, 2023

Filed

Aug 30, 2023

To disclose

9 weeks

Affected

70state residents only

Linked

9 filings

Confidence

68%
Full breach record for CareSource6 incidents on file

CareSource, a managed care organization, reported a breach involving its MOVEit file transfer vendor. The CL0P ransomware group exploited a vulnerability on May 31, 2023, exfiltrating data including PHI, SSNs, and member details. CareSource discovered the breach on June 27, 2023, patched the system, and engaged Kroll for forensics. 70 New Hampshire residents were affected. Notifications began August 25, 2023, offering credit monitoring.

Leak gap clock Leak >30d9 weeks discovery → filing
unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 27 days
discovery → filing · 9 weeks / 64 days

May 31, 2023

Begins

Jun 27, 2023

Discovered

Aug 30, 2023

Filed

vs. sector median

2 wks faster

This filing is one of 9 about the same incident.View merged incident
A leak claim by cl0p about this victim predates this filing by 62 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Regulatory filings (7) · sorted by filing gap

Show 3 more filingsup to 241d gap

Filing propagation · 8 filings · 7 states

View merged incident ↗
Illinois State AGJan 1 · first
HHS OCR+207d
New Hampshire State AG+241d · this page

Pattern: first filing Jan 1 (IL), last Aug 30 (NH) — a 241-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.