HackingProfessional ServicesProfessional ServicesVulnerability ExploitZero-DaySupply Chain (3P Vendor)Data ExfiltratedIdentity (basic)Government IDMediumContained

Westat, Inc.

bd_03476d52a3c7f670 · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 30, 2023

Filed

Jul 21, 2023

To disclose

7 weeks

Affected

Not disclosed

Linked

11 records

Confidence

66%

Full breach record for Westat, Inc. →2 incidents on file

Westat, Inc. notified consumers of a data breach involving its third-party vendor, Progress MOVEit. A zero-day vulnerability allowed unauthorized copying of data from a MOVEit server between May 28-29, 2023. Impacted data included names, dates of birth, and Social Security numbers. Westat engaged forensic specialists, applied patches, and offered credit monitoring services.

J jump to incidentP pin to compareR raw source

Vermont clock⏱ VT AG >14 bday7 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 2 days

discovery → filing · 7 weeks / 52 days

May 28, 2023

Begins

May 30, 2023

Discovered

Jul 21, 2023

Filed

vs. sector median

12 wks faster

This filing is one of 11 records about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitecl0pbd_752092ce6faa5dd32023-07-10 · +11dVerified by operator

Regulatory filings (9) · sorted by filing gap

New Hampshire State AGbd_241c67cca32741002023-07-21Verified by operator
Montana State AGbd_8839ed78d84140492023-07-21Candidate
Indiana State AGbd_991dc2d92271be1c2023-07-21Verified by operator
Maine State AGbd_be6506ff947b42aa2023-07-21Candidate

Show 5 more filings ↓up to 105d gap

Massachusetts State AGbd_f7f9fd512c2dec0d2023-07-21Verified by operator
Indiana State AGbd_4027da82b6e67c622023-10-13 · +84dVerified
HHS OCRbd_5b63e0b82f445a712023-10-13 · +84dVerified
South Carolina State AGbd_2e1ea343e7bb4ee72023-10-16 · +87dVerified by operator
HHS OCRbd_0a5c6e5ef62bfc8d2023-11-03 · +105dCandidate

Name: Westat, Inc.
norm: westat
Domain: westat.com

Name: Westat, Inc.
norm: westat
Domain: westat.com
Industry: Professional Servicesllm

Discovered: May 30, 2023
Breach occurred: May 28, 2023 – May 29, 2023
Undetected for: 2 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 21, 2023
Affected individuals: Not disclosed
Data types: Identity (basic)Government ID
Data elements: Date of birth
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain CompromiseT1190 Exploit Public-Facing ApplicationT1074 Data Staged
Threat actor: ExternalFinancial
Initial access: exploit_public_facing

During the incident: Engaged third-party forensic specialists to assist in conducting a comprehensive investigation
Implemented all the patches to date
Offering 12/24 months of credit monitoring and identity restoration services through IDX
Changes made: Implemented all the patches to date
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 weeks(52 days from discovery to filing)
Compliance flags: VT AG >14 bday
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 10 filings · 8 states

View merged incident ↗

New Hampshire State AGJul 21 · first

Montana State AGJul 21 · first

Indiana State AGJul 21 · first

Maine State AGJul 21 · first

Massachusetts State AGJul 21 · first

Vermont State AGJul 21 · first · this page

Indiana State AG+84d

HHS OCR+84d

South Carolina State AG+87d

HHS OCR+105d

Pattern: first filing Jul 21 (NH), last Nov 3 (MD) — a 105-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ago.vermont.gov/document/2023-07-21-westat-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 21, 2023
Raw hash: 37e317410a38ee64d690cb7098031f07c38d872574c5731799d15bb38d9de556

Linked disclosures

Ransomware claims (1)

Regulatory filings (9) · sorted by filing gap

Reporting entityWestat, Inc.

Victim entityWestat, Inc.

Incidentdiscovered May 30, 2023

Stated responseEngaged third-party forensic specialists to assist in conducting a comprehensive investigation

ComplianceVT AG >14 bday

Extraction provenanceno artifact recorded

Source provenanceago.vermont.gov