HackingData ExfiltratedTargetedPHIHEALTH_BASICIDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTHighContained
A&A Services dba Sav-Rx
bd_1333cc9cc2dc136d · schema v1 · pii pii-v1
Full breach record for A&A Services dba Sav-Rx →A&A Services dba Sav-Rx notified consumers of a data breach affecting protected health information (PHI) and personal data of employees. The incident involved unauthorized access to non-clinical systems starting October 3, 2023. Data types included PHI, SSNs, and financial account numbers. The company engaged forensic experts, notified law enforcement, and offered 24 months of credit monitoring. Rhode Island had 1,006 affected residents.
Vermont clock✗ VT AG >45 bday33 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
This filing is one of 2 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (1) · sorted by filing gap
- bd_815e884fb2c0f6c2New Hampshire State AGfiled 2024-05-24Verified
Source provenance
- Source URL
- https://ago.vermont.gov/document/2024-05-24-aa-services-dba-sav-rx-data-breach-notice-consumers-0
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- May 24, 2024
- Raw hash
- 078495621ad22cb980a957d9b6116ae5c8e85b004f1192cd80eeb34f7e968818
Reporting entity
- Name
- A&A Services dba Sav-Rxnorm: a a services dba sav rx
Victim entity
- Name
- A&A Services dba Sav-Rxnorm: a a services dba sav rx
Incident
- Discovered
- Oct 8, 2023
- Materiality determined
- —
- Notification sent
- May 24, 2024
- Affected individuals
- 1,006
- Data types
- PHIHEALTH_BASICIDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNT
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1190 Exploit Public-Facing ApplicationT1119 Automated CollectionT1074 Data Staged
- Threat actor
- ExternalFinancial
- Regulator citations
- Notified law enforcement authorities
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 33 weeks(229 days from discovery to filing)
- Compliance flags
- VT AG >45 bday
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.