HackingHealthcareProfessional ServicesHealthcareStolen CredentialsCustomer Data InvolvedDownstream VictimsPIIPHIIdentity (basic)Health (basic)LowContained

Imagine360

bd_0f8c577caa8ceb5e · schema v1 · pii pii-v1

Severity

Low

Discovered

Jan 24, 2025

Filed

Mar 7, 2025

To disclose

6 weeks

Affected

27state residents only

Linked

3 filings

Confidence

66%

Full breach record for Imagine360 →5 incidents on file

Imagine360, LLC notified New Hampshire residents that unauthorized access to an employee's email account occurred on May 10 and May 16, 2024. The company discovered the breach on January 24, 2025. Personal information and protected health information were accessible in the emails. No evidence of data download or copying was found. Imagine360 reset passwords, enhanced email security, and offered credit monitoring to affected individuals.

J jump to incidentP pin to compareR raw source

Leak gap clock✗ Leak >180d6 weeks discovery → filing

Incident timeline

undetected · 259 days

discovery → filing · 6 weeks / 42 days

May 10, 2024

Begins

Jan 24, 2025

Discovered

Mar 7, 2025

Filed

vs. sector median

6 wks faster

This filing is one of 3 about the same incident.View merged incident

A leak claim by cl0p about this victim predates this filing by 714 days.View originating leak claim

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_8939006c91419b172025-03-07Verified
Illinois State AGbd_c884d8f943b25d6d2025-03-01 · +6dVerified

Name: Imagine360
norm: imagine360
Domain: imagine360.com

Name: Imagine360
norm: imagine360
Domain: imagine360.com
Industry: HealthcarellmProfessional Servicesllm

Discovered: Jan 24, 2025
Breach occurred: May 10, 2024 – May 16, 2024
Undetected for: 259 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 7, 2025
Affected individuals: 27state-resident count only
Data types: PIIPHIIdentity (basic)Health (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Providing written notice of this event to relevant state regulatorsProviding notice on Imagine360’s website pursuant to the Health Insurance Portability and Accountability Act (HIPAA)The U.S. Department of Health and Human Services will be receiving supplemental notice of this event
Initial access: valid_credentials

During the incident: Completed an enterprise-wide password reset
Confirmed the security of our email environment
Initiated an investigation into the activity
Implemented additional security measures within its email environment
Completed a review of its policies and procedures to mitigate reoccurrence
Provided access to credit monitoring services for through IDX to individuals receiving notification
Providing written notice of this event to relevant state regulators
Providing written notice to the three major credit reporting agencies
Providing notice on Imagine360’s website pursuant to HIPAA
Notifying the U.S. Department of Health and Human Services
Changes made: Implemented additional security measures within its email environment
Completed a review of its policies and procedures to mitigate reoccurrence of this type of event
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(42 days from discovery to filing)
Compliance flags: Leak >180d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Illinois State AGMar 1 · first

Massachusetts State AG+6d

New Hampshire State AG+6d · this page

Pattern: first filing Mar 1 (IL), last Mar 7 (NH) — a 6-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/imagine360-20250307.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 7, 2025
Raw hash: da75bdecb23d60eff372209b8aa6003f240c634109e2b653f2e06ec8076fe4af

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityImagine360

Victim entityImagine360

Incidentdiscovered Jan 24, 2025

Stated responseCompleted an enterprise-wide password reset

ComplianceLeak >180d

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov