HackingHealthcareHealthcareCustomer Data InvolvedIdentity (basic)Government IDCritical

Kannact

bd_07529270f797a54a · schema v1 · pii pii-v1

Severity

Critical

Discovered

Mar 13, 2023

Filed

Sep 22, 2023

To disclose

28 weeks

Affected · nationwide

117,968284 in this filing

Linked

14 filings

Confidence

50%

Full breach record for Kannact →

Kannact, Inc., a healthcare organization, experienced an external system breach (hacking) on February 6, 2023, which was discovered on March 13, 2023. The breach affected 284 Maine residents, compromising their names and Social Security Numbers. The company provided written notification to the affected individuals on August 14, 2023, and offered 12 months of credit monitoring and identity theft protection services.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Mar 13, 2023 → Filed with AG Sep 22, 2023193d ✗ ME AG >90d28 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 35 days

discovery → filing · 28 weeks / 193 days

Feb 6, 2023

Begins

Mar 13, 2023

Discovered

Sep 22, 2023

Filed

vs. sector median

+15 wks slower

This filing is one of 14 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

Massachusetts State AGbd_80f53accc2f0e5622023-09-22Verified
Oregon State AGbd_c082f97720f3e6962023-09-22Verified
California State AGbd_cd661c6340a504802023-09-22Verified
Montana State AGbd_2bbf967b1d0ff94c2023-09-21 · +1dVerified

Show 6 more filings ↓up to 163d gap

New Hampshire State AGbd_4b9e8cf6b4ed74b12023-09-29 · +7dVerified
Montana State AGbd_29de722ce2bf8e1f2023-10-10 · +18dVerified
Indiana State AGbd_1e6199d96e8d96ed2023-08-14 · +39dVerified
HHS OCRbd_7385e75f799452482023-06-20 · +94dVerified by operator
New Hampshire State AGbd_94cb9ce753b551842023-04-18 · +157dVerified
Maine State AGbd_2f2008bf8d79c8e92023-04-12 · +163dVerified

Showing first 10 of 13 linked disclosures.

Name: Kannact
norm: kannact
Domain: kannact.com

Name: Kannact
norm: kannact
Domain: kannact.com
Industry: Healthcarellm

Discovered: Mar 13, 2023
Breach occurred: Feb 6, 2023
Undetected for: 35 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 14, 2023
Affected individuals: 117,968state + nationwide
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Unauthorized Access
Threat actor: External

Changes made: Offered 12 months of credit monitoring and identity theft protection services
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 28 weeks(193 days from discovery to filing)
Compliance flags: ME AG >90d · 193dME resident >60d · 154d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Mar 13, 2023
→ Filed with AG: Sep 22, 2023
193d 90 days ME AG >90d
Maine
Discovered: Mar 13, 2023
→ Notified: Aug 14, 2023
154d 60 days (analyst band; statutory cap is 30 days) ME resident >60d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Mar 13, 2023 → Filed with AG: Sep 22, 2023	193d	90 days	ME AG >90d
Maine	Discovered: Mar 13, 2023 → Notified: Aug 14, 2023	154d	60 days (analyst band; statutory cap is 30 days)	ME resident >60d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 7 states

View merged incident ↗

Maine State AGApr 12 · first

New Hampshire State AG+6d

HHS OCR+69d

Indiana State AG+124d

Montana State AG+162d

Massachusetts State AG+163d

Oregon State AG+163d

California State AG+163d

Maine State AG+163d · this page

New Hampshire State AG+170d

Montana State AG+181d

Pattern: first filing Apr 12 (ME), last Oct 10 (MT) — a 181-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Cascade drawn from the first 10 linked disclosures of 13 — the full spread may be wider.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/40fadfa5-23d2-4d51-b78f-eb317a06dd24.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 22, 2023
Raw hash: eb3c45d03f8d1ec9edc365b0775fc75d26645937e0185f197013f989ab38a58d

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entityKannact

Victim entityKannact

Incidentdiscovered Mar 13, 2023

Stated responseOffered 12 months of credit monitoring and identity theft protection services

ComplianceME AG >90d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov