HackingHealthcareHealthcareCustomer Data InvolvedTargetedIdentity (basic)Government IDHealth (basic)PHICriticalContained

LIVANOVA USA, INC.

bd_0d82e63a7db61860 · schema v1 · pii pii-v1

Severity

Critical

Discovered

Nov 19, 2023

Filed

Jun 21, 2024

To disclose

31 weeks

Affected · nationwide

129,219490 in this filing

Linked

13 filings

Confidence

66%

Full breach record for LIVANOVA USA, INC. →2 incidents on file

LivaNova USA, Inc. reported an external system breach (hacking) occurring between Oct 26 and Nov 23, 2023, discovered on Nov 19, 2023. The incident compromised PHI, SSNs, and PII of ~129,219 individuals. LivaNova engaged forensic experts, coordinated with law enforcement, took systems offline, and offered 24 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Nov 19, 2023 → Filed with AG Jun 21, 2024215d ✗ ME AG >90d31 weeks discovery → filing

Incident timeline

undetected · 24 days

discovery → filing · 31 weeks / 215 days

Oct 26, 2023

Begins

Nov 19, 2023

Discovered

Jun 21, 2024

Filed

vs. sector median

+18 wks slower

This filing is one of 13 about the same incident.View merged incident

A leak claim by lockbit_3 about this victim predates this filing by 196 days.View originating leak claim

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

California State AGbd_4cbe12544ebb3ad32024-06-21Verified
Oregon State AGbd_86a5e8beca6d0b072024-06-21Verified
Washington State AGLockBit 3.0bd_8903a5d76c236c4e2024-06-21Verified
South Carolina State AGbd_e9d8e55849af71d62024-06-24 · +3dVerified

Show 6 more filings ↓up to 51d gap

Vermont State AGbd_3a8a8a6bbce6d40f2024-05-31 · +21dVerified
Indiana State AGbd_e105ceeb7efaf9532024-05-31 · +21dVerified
Massachusetts State AGbd_156f51d29fa5f8922024-05-24 · +28dVerified
Montana State AGbd_d3ef1f04f09b86812024-05-23 · +29dVerified
California State AGbd_a3647fcc70a4a30a2024-07-30 · +39dVerified
Illinois State AGbd_6c940f7b15eedc162024-05-01 · +51dCandidate

Showing first 10 of 12 linked disclosures.

Name: LIVANOVA USA, INC.
norm: livanova usa
Domain: livanova.com

Name: LIVANOVA USA, INC.
norm: livanova usa
Domain: livanova.com
Industry: Healthcarellm

Discovered: Nov 19, 2023
Breach occurred: Oct 26, 2023 – Nov 23, 2023
Undetected for: 24 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 31, 2024
Affected individuals: 129,219state + nationwide
Data types: Identity (basic)Government IDHealth (basic)PHI
Data elements: Social Security numberDate of birthMedical information
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified Maine Attorney General
Initial access: exploit_public_facing

During the incident: Began an investigation with assistance from external cybersecurity experts
Coordinated with law enforcement
Took certain systems offline
Changes made: Offered 24 months of complimentary credit monitoring and identity protection services through Experian
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 31 weeks(215 days from discovery to filing)
Compliance flags: ME AG >90d · 215dME resident >180d · 194dLeak >180d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Nov 19, 2023
→ Filed with AG: Jun 21, 2024
215d 90 days ME AG >90d
Maine
Discovered: Nov 19, 2023
→ Notified: May 31, 2024
194d 180 days ME resident >180d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Nov 19, 2023 → Filed with AG: Jun 21, 2024	215d	90 days	ME AG >90d
Maine	Discovered: Nov 19, 2023 → Notified: May 31, 2024	194d	180 days	ME resident >180d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 10 states

View merged incident ↗

Illinois State AGMay 1 · first

Montana State AG+22d

Massachusetts State AG+23d

Vermont State AG+30d

Indiana State AG+30d

California State AG+51d

Oregon State AG+51d

Washington State AG+51d

Maine State AG+51d · this page

South Carolina State AG+54d

California State AG+90d

Pattern: first filing May 1 (IL), last Jul 30 (CA) — a 90-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Cascade drawn from the first 10 linked disclosures of 12 — the full spread may be wider.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/f2801e5a-f4c1-44d4-8626-d7aadd095aac.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 21, 2024
Raw hash: 86fa61c006751b0d8f235b00b309d1350b76ecb944dcd04f9e6aa78d97c60c1f

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entityLIVANOVA USA, INC.

Victim entityLIVANOVA USA, INC.

Incidentdiscovered Nov 19, 2023

Stated responseBegan an investigation with assistance from external cybersecurity experts

ComplianceME AG >90d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov