DisclosureLens
HackingHealthcareCustomer Data InvolvedIdentity (basic)Government IDMediumContained

IMX Medical Management Services

bd_127ca3a499b242cd · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 1, 2022

Filed

Jul 12, 2023

To disclose

45 weeks

Affected

3scope not determined

Linked

8 filings

Confidence

50%
Full breach record for IMX Medical Management Services →2 incidents on file

IMX Medical Management Services reported an external system breach that occurred between June 2022 and October 26, 2022. The breach, discovered on September 1, 2022, affected three Maine residents. The compromised information included names and driver's license or non-driver identification card numbers. IMX offered 24 months of complimentary credit monitoring and identity protection services through Equifax to those affected.

Maine clockDiscovered Sep 1, 2022 → Filed with AG Jul 12, 2023314d ✗ ME AG >90d45 weeks discovery → filing
⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 92 days
discovery → filing · 45 weeks / 314 days

Jun 1, 2022

Begins

Sep 1, 2022

Discovered

Jul 12, 2023

Filed

This filing is one of 8 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (7) · sorted by filing gap

Show 3 more filings ↓up to 20d gap

Filing propagation · 8 filings · 8 states

View merged incident ↗
Maine State AGJul 12 · first · this page
Indiana State AG+9d
California State AG+15d
Montana State AG+15d
Delaware State AG+15d
Massachusetts State AG+15d
Vermont State AG+15d
New Hampshire State AG+20d

Pattern: first filing Jul 12 (ME), last Aug 1 (NH) — a 20-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.