MalwareTechnologyHealthcareInformationRansomwareRansom DemandedCustomer Data InvolvedIdentity (basic)Government IDHealth (basic)PHIMediumContained

Gaia Software LLC

bd_13756db037dce6f4 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 5, 2024

Filed

Aug 30, 2024

To disclose

30 weeks

Affected

2state residents only

Linked

7 filings

Confidence

65%

Full breach record for Gaia Software LLC →2 incidents on file

Gaia Software, LLC notified Montana and other states of a ransomware attack detected on February 5, 2024. The attack targeted Gaia's network, which hosts electronic medical records for American Home Dialysis. Gaia confirmed no evidence of specific misuse but noted potential exposure of names, SSNs, DOBs, and health information. Gaia engaged forensic investigators, secured the network, and offered 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 30 weeks / 207 days

Feb 5, 2024

Begins

Feb 5, 2024

Discovered

Aug 30, 2024

Filed

vs. sector median

+11 wks slower

This filing is one of 7 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

New Hampshire State AGbd_8fcedc3d23ee23b02024-06-28 · +63dVerified
Massachusetts State AGbd_96830e28db2788962024-06-28 · +63dVerified
Vermont State AGbd_e8f5e0199c84c0142024-06-28 · +63dCandidate
Indiana State AGbd_ec3e0ad62243d3052024-06-28 · +63dVerified

Show 2 more filings ↓up to 90d gap

Maine State AGbd_ee00f47ec9a92fe72024-06-28 · +63dVerified
Illinois State AGbd_ff253cef1f952f382024-06-01 · +90dVerified

Name: Gaia
norm: gaia
Domain: gaia.com

Name: Gaia Software LLC
norm: gaia software
Industry: TechnologyllmHealthcarellm

Discovered: Feb 5, 2024
Breach occurred: Feb 5, 2024
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 30, 2024
Affected individuals: 2state-resident count only
Data types: Identity (basic)Government IDHealth (basic)PHI
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1190 Exploit Public-Facing Application
Threat actor: ExternalFinancial
Initial access: exploit_public_facing

During the incident: Engaged external cybersecurity experts
Secured its network environment
Launched a thorough investigation
Performed investigation with independent IT security and forensic investigators
Providing access to SingleBureauCreditMonitoring/SingleBureauCreditReport/SingleBureauCreditScoreservices at no charge
Providing proactive fraud assistance
Reviewed and taken steps to enhance its policies and procedures relating to the security of its systems
Enhanced information life cycle management
Changes made: Implementing additional safeguards and enhanced security measures
Enhanced policies and procedures relating to the security of its systems
Enhanced information life cycle management
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 30 weeks(207 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 7 states

View merged incident ↗

Illinois State AGJun 1 · first

New Hampshire State AG+27d

Massachusetts State AG+27d

Vermont State AG+27d

Indiana State AG+27d

Maine State AG+27d

Montana State AG+90d · this page

Pattern: first filing Jun 1 (IL), last Aug 30 (MT) — a 90-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-notification-letter-1650.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 30, 2024
Raw hash: 5d49fb1506d09f35874ae2834bac817aa05028e690c4ae84509b98630a549890

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityGaia

Victim entityGaia Software LLC

Incidentdiscovered Feb 5, 2024

Stated responseEngaged external cybersecurity experts

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov