HackingTechnologyInformationStolen CredentialsTargetedCustomer Data InvolvedPIIIdentity (basic)LowContained

CareRev

bd_09fbfb62c13c0869 · schema v1 · pii pii-v1

Severity

Low

Discovered

Aug 15, 2023

Filed

Sep 14, 2023

To disclose

4 weeks

Affected

1state residents only

Linked

2 filings

Confidence

64%

Full breach record for CareRev →

CareRev notified Montana residents of a data breach where unauthorized actors accessed user accounts between August 12-16, 2023. Discovered August 15, 2023. CareRev reset credentials, engaged FBI, and offered 2 years of credit monitoring. No specific data types confirmed viewed, but account access implies PII exposure.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 3 days

discovery → filing · 4 weeks / 30 days

Aug 12, 2023

Begins

Aug 15, 2023

Discovered

Sep 14, 2023

Filed

vs. sector median

14 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Indiana State AGbd_b9b6663025f09bb92023-09-14Verified

Name: CareRev
norm: carerev

Name: CareRev
norm: carerev
Industry: Technologyllm

Discovered: Aug 15, 2023
Breach occurred: Aug 12, 2023 – Aug 16, 2023
Undetected for: 3 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 14, 2023
Affected individuals: 1state-resident count only
Data types: PIIIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified the FBI
Initial access: valid_credentials

During the incident: Activated its incident response procedures
Took steps to expel the unauthorized actor from the affected accounts
Notified the FBI
Reset the passwords and access tokens for all users
Arranged for two years of free credit monitoring and identity protection services for you through Experian IdentityWorks
Changes made: Resetting and requiring stronger user passwords
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 4 weeks(30 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Indiana State AGSep 14 · first

Montana State AGSep 14 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-notification-letter-677.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 14, 2023
Raw hash: 86e8966de24307e910c0af6b3591f082e85a87ffeefd4b04884baff28b0e5d42

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityCareRev

Victim entityCareRev

Incidentdiscovered Aug 15, 2023

Stated responseActivated its incident response procedures

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov