HackingData ExfiltratedTargetedIDENTITY_BASICIDENTITY_GOVERNMENTHEALTH_BASICFINANCIAL_ACCOUNTCREDENTIALSMediumContained
CHANGE HEALTHCARE INC.
bd_1467986906075ca0 · schema v1 · pii pii-v1
Full breach record for CHANGE HEALTHCARE INC. →Change Healthcare disclosed a data breach where a cybercriminal accessed its computer system between Feb 17-20, 2024. The incident involved unauthorized access and exfiltration of data including contact info, health insurance data, health data, billing/payment data, and government IDs. CHC notified law enforcement, engaged a special team, and offered 2 years of free credit monitoring.
Vermont clock✗ VT AG >45 bday23 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
This filing is one of 8 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (7) · sorted by filing gap
- bd_20fef244fbf67f71Montana State AGfiled 2024-08-02(4d gap)Verified
- bd_546b3d03391ed182New Hampshire State AGfiled 2024-08-02(4d gap)Verified
- bd_6999730badb3aebbCalifornia State AGfiled 2024-08-03(5d gap)Verified
- bd_788f5843714453cbOregon State AGfiled 2024-08-03(5d gap)Verified
Show 3 more filings ↓Show fewer ↑up to 49d gap
- bd_dc48a09555e80a91Washington State AGfiled 2024-08-03(5d gap)Verified
- bd_7573d03228639e7bHHS OCRfiled 2024-07-19(10d gap)Verified
- bd_1091c4bb67ec440aOregon State AGfiled 2024-09-16(49d gap)Verified
Source provenance
- Source URL
- https://ago.vermont.gov/document/2024-07-29-change-healthcare-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jul 29, 2024
- Raw hash
- b0729fa3ce751974bc9099327bd33d3d9d94360623151b6a1a06b373b1449fab
Reporting entity
- Name
- CHANGE HEALTHCARE INC.norm: change healthcare
- Domain
- changehealthcare.com
Victim entity
- Name
- CHANGE HEALTHCARE INC.norm: change healthcare
- Domain
- changehealthcare.com
Incident
- Discovered
- Feb 21, 2024
- Materiality determined
- Jul 29, 2024
- Notification sent
- Jul 29, 2024
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENTHEALTH_BASICFINANCIAL_ACCOUNTCREDENTIALS
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1190 Exploit Public-Facing ApplicationT1078 Valid AccountsT1041 Exfiltration Over C2 Channel
- Threat actor
- ExternalFinancial
- Regulator citations
- Called law enforcement
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 23 weeks(159 days from discovery to filing)
- Compliance flags
- VT AG >45 bday
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.