MisusePHIHealth (basic)Identity (basic)LowContained

PRIME THERAPEUTICS LLC

bd_0e09ddfe4a9a6e64 · schema v1 · pii pii-v2

Severity

Low

Discovered

Jun 26, 2025

Filed

Aug 25, 2025

To disclose

—

Affected

Not disclosed

Linked

4 filings

Confidence

66%

Full breach record for PRIME THERAPEUTICS LLC →109 incidents on file

Prime Therapeutics LLC reported a data security incident involving its customer service vendor, Sagility USA. An unauthorized individual acted as a contact center employee with access to Prime's systems from October 2024 to June 26, 2025. The incident exposed Protected Health Information (PHI) including names, addresses, DOB, health plan IDs, and prescription details. No SSN or financial account data was involved. Sagility revoked access, terminated the individual, and reported the matter to law enforcement.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 268 days

Oct 1, 2024

Begins

Jun 26, 2025

Discovered

Aug 25, 2025

Filed

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

HHS OCRbd_47d6d2b54bf7aaea2025-08-25Verified
Texas State AGbd_2668740d80a26bdb2025-10-09 · +45dCandidate
Illinois State AGbd_60456115944fa1882025-07-01 · +55dVerified

Name: PRIME THERAPEUTICS LLC
norm: prime therapeutics

Name: PRIME THERAPEUTICS LLC
norm: prime therapeutics

Discovered: Jun 26, 2025
Breach occurred: Oct 1, 2024 – Jun 26, 2025
Undetected for: 268 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: PHIHealth (basic)Identity (basic)
Attack vector: Insider
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: Internal
Initial access: valid_credentials

During the incident: Revoked the individual's access to the contact center system
The individual was terminated
Reported to law enforcement
Actively reviewing its internal procedures to identify opportunities for strengthening security
Changes made: Reinforcing existing policies and practices
Implementing additional safeguards to help prevent similar incidents in the future
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Illinois State AGJul 1 · first

HHS OCR+55d

Nebraska State AG+55d · this page

Texas State AG+100d

Pattern: first filing Jul 1 (IL), last Oct 9 (TX) — a 100-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://nebraska.gov/ago/data-breach/documents/bd75673b-dd5b-4a14-9412-71b95939e35e.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 25, 2025
Raw hash: bf0631342ca5d3a978ee60adafc8153da82a161852683462e370526c04375f96

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityPRIME THERAPEUTICS LLC

Victim entityPRIME THERAPEUTICS LLC

Incidentdiscovered Jun 26, 2025

Stated responseRevoked the individual's access to the contact center system

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancenebraska.gov