HackingHealthcareHealthcareTargetedData ExfiltratedIdentity (basic)Government IDHealth (basic)PHIHighContained

Therapeutic Health Services

bd_0b0839c7602e26eb · schema v1 · pii pii-v1

Severity

High

Discovered

Feb 26, 2024

Filed

Jul 19, 2024

To disclose

21 weeks

Affected · nationwide

14,1647 in this filing

Linked

12 filings

Confidence

65%

Full breach record for Therapeutic Health Services →

Therapeutic Health Services (THS) reported an external system breach (hacking) occurring on February 24, 2024, discovered on February 26, 2024. The incident affected 14,164 individuals, including 7 Maine residents. Compromised data included names, SSNs, DOBs, and medical/health information. THS engaged third-party experts, notified law enforcement, and provided 12 months of credit monitoring via CyEx. Notices were sent on July 18, 2024.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Feb 26, 2024 → Filed with AG Jul 19, 2024144d ✗ ME AG >90d21 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 2 days

discovery → filing · 21 weeks / 144 days

Feb 24, 2024

Begins

Feb 26, 2024

Discovered

Jul 19, 2024

Filed

vs. sector median

+10 wks slower

This filing is one of 12 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

Massachusetts State AGbd_76c95b587b2d6ea42024-07-19Verified by operator
Indiana State AGbd_9f2b9b64c727f93a2024-07-19Verified by operator
California State AGbd_db7590df7889e1192024-07-19Verified by operator
Vermont State AGbd_3160e87da8cd14602024-07-18 · +1dVerified by operator

Show 6 more filings ↓up to 104d gap

Montana State AGbd_793062f3ad804d272024-07-18 · +1dVerified
New Hampshire State AGbd_5fa83b73c13ad3b92024-07-23 · +4dVerified by operator
Washington State AGbd_f491b2810a3b9c5c2024-07-11 · +8dVerified
HHS OCRbd_b12268e09d53b7412024-04-25 · +85dVerified
New Hampshire State AGbd_ed78a3330b539efb2024-10-30 · +103dVerified
Oregon State AGbd_1e7c1a6bf43c0ed92024-10-31 · +104dVerified by operator

Showing first 10 of 11 linked disclosures.

Name: Therapeutic Health Services
norm: therapeutic health
Domain: ths-wa.org

Name: Therapeutic Health Services
norm: therapeutic health
Domain: ths-wa.org
Industry: Healthcarellm

Discovered: Feb 26, 2024
Breach occurred: Feb 24, 2024
Undetected for: 2 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 18, 2024
Affected individuals: 14,164state + nationwide
Data types: Identity (basic)Government IDHealth (basic)PHI
Data elements: Date of birthMedical information
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: External
Regulator citations: Notified Maine Attorney General
Initial access: exploit_public_facing

During the incident: Secured and remediated the compromise
Engaged additional third-party experts
Hardened and enhanced data security
Commenced an investigation
Notified law enforcement
Changes made: Enhanced cyber preparedness through additional awareness training
Updating procedures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 21 weeks(144 days from discovery to filing)
Compliance flags: ME AG >90d · 144dME resident >60d · 143dLeak >90d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Feb 26, 2024
→ Filed with AG: Jul 19, 2024
144d 90 days ME AG >90d
Maine
Discovered: Feb 26, 2024
→ Notified: Jul 18, 2024
143d 60 days (analyst band; statutory cap is 30 days) ME resident >60d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Feb 26, 2024 → Filed with AG: Jul 19, 2024	144d	90 days	ME AG >90d
Maine	Discovered: Feb 26, 2024 → Notified: Jul 18, 2024	143d	60 days (analyst band; statutory cap is 30 days)	ME resident >60d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 9 states

View merged incident ↗

HHS OCRApr 25 · first

Washington State AG+77d

Vermont State AG+84d

Montana State AG+84d

Massachusetts State AG+85d

Indiana State AG+85d

California State AG+85d

Maine State AG+85d · this page

New Hampshire State AG+89d

New Hampshire State AG+188d

Oregon State AG+189d

Pattern: first filing Apr 25 (WA), last Oct 31 (OR) — a 189-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Cascade drawn from the first 10 linked disclosures of 11 — the full spread may be wider.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/ec54fd2d-56c3-4dc7-a0f3-56c859b15ba1.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 19, 2024
Raw hash: 0d9e3cf72a8aed47db0d155e860f73e1042e14824f355b4a4740d5ec67fbc7d5

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entityTherapeutic Health Services

Victim entityTherapeutic Health Services

Incidentdiscovered Feb 26, 2024

Stated responseSecured and remediated the compromise

ComplianceME AG >90d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov