HackingHealthcareHealthcareCustomer Data InvolvedData ExfiltratedDelayed DiscoveryIdentity (basic)Government IDPHIHighContained

Valley Oaks Health

bd_0deb6fccbc69a098 · schema v1 · pii pii-v1

Severity

High

Discovered

Feb 2, 2024

Filed

Mar 18, 2024

To disclose

6 weeks

Affected · nationwide

50,3522 in this filing

Linked

5 filings

Confidence

65%

Full breach record for Valley Oaks Health →

Healthcare provider Valley Oaks Health reported an external system breach that occurred on June 8, 2023, and was discovered on February 2, 2024. The breach compromised the names and Social Security numbers of 50,352 individuals. Valley Oaks Health began notifying affected parties on March 18, 2024, and offered 12 months of complimentary credit monitoring services through IDX.

J jump to incidentP pin to compareR raw source

Leak gap clock✗ Leak >180d6 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 239 days

discovery → filing · 6 weeks / 45 days

Jun 8, 2023

Begins

Feb 2, 2024

Discovered

Mar 18, 2024

Filed

vs. sector median

5 wks faster

This filing is one of 5 about the same incident.View merged incident

A leak claim by lockbit_3 about this victim predates this filing by 272 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitelockbit_3bd_0fe44aa766f96efa2023-06-20 · +272dVerified by operator

Regulatory filings (3) · sorted by filing gap

HHS OCRbd_0cf6773941c542b72024-03-18Verified
Indiana State AGbd_a8feb3d2141e8ef62024-03-18Verified
Massachusetts State AGbd_125c62659f3457342024-03-19 · +1dVerified

Name: Valley Oaks Health
norm: valley oaks health
Domain: valleyoaks.org

Name: Valley Oaks Health
norm: valley oaks health
Domain: valleyoaks.org
Industry: Healthcarellm

Discovered: Feb 2, 2024
Breach occurred: Jun 8, 2023
Undetected for: 239 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 18, 2024
Affected individuals: 50,352state + nationwide
Data types: Identity (basic)Government IDPHI
Data elements: Social Security number
Attack vector: Unauthorized Access
Threat actor: External

During the incident: Notified affected consumers in writing on March 18, 2024
Offered 12 months of complimentary credit monitoring via IDX to individuals whose Social Security number was affected
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(45 days from discovery to filing)
Compliance flags: Leak >180dME AG >30d · 45d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Feb 2, 2024
→ Filed with AG: Mar 18, 2024
45d 30 days (soft) ME AG >30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Feb 2, 2024 → Filed with AG: Mar 18, 2024	45d	30 days (soft)	ME AG >30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 3 states

View merged incident ↗

HHS OCRMar 18 · first

Indiana State AGMar 18 · first

Maine State AGMar 18 · first · this page

Massachusetts State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/32e6fa0b-cdda-401c-84e2-14586a5881bf.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 18, 2024
Raw hash: d43cd026fb9c2c1253a62e3777a0db89f42961a32835b3f32a80929072085fa0

Linked disclosures

Ransomware claims (1)

Regulatory filings (3) · sorted by filing gap

Reporting entityValley Oaks Health

Victim entityValley Oaks Health

Incidentdiscovered Feb 2, 2024

Stated responseNotified affected consumers in writing on March 18, 2024

ComplianceLeak >180d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov