HackingVulnerability ExploitData ExfiltratedTargetedIDENTITY_BASICIDENTITY_GOVERNMENTMediumContained
The Group Health Plans of Stanford Health Care
bd_037042af7f219bfc · schema v1 · pii pii-v1
Full breach record for The Group Health Plans of Stanford Health Care →Welltok, Inc. notified The Group Health Plans of Stanford Health Care of a data breach involving the MOVEit Transfer server. An unknown actor exploited software vulnerabilities on May 30, 2023, to access and exfiltrate data. The incident was discovered on August 11, 2023. Affected data includes identity information. Welltok engaged third-party cybersecurity specialists and is offering credit monitoring services.
Vermont clock✗ VT AG >45 bday14 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed6 affectedView incident
Source provenance
- Source URL
- https://ago.vermont.gov/document/2023-11-18-group-health-plans-stanford-health-care-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Nov 18, 2023
- Raw hash
- c9eb95b548ed9a5a0e697439dbd9369ff6bc3f92ba146781356cbcb64f1551b2
Reporting entity
- Name
- Welltoknorm: welltok
- Domain
- welltok.com
Victim entity
- Name
- The Group Health Plans of Stanford Health Carenorm: the group health plans of stanford health care
Incident
- Discovered
- Aug 11, 2023
- Materiality determined
- —
- Notification sent
- Nov 17, 2023
- Affected individuals
- 6
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENT
- Attack vector
- Misconfiguration
- MITRE ATT&CK
- T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
- Threat actor
- ExternalFinancial
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 14 weeks(99 days from discovery to filing)
- Compliance flags
- VT AG >45 bday
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.