DisclosureLens
HackingHealthcareHealthcareIdentity (basic)Financial accountFinancial credentialsGovernment IDHighContained

Synergy Healthcare Services

bd_1664820794ed528e · schema v1 · pii pii-v1

Severity

High

Discovered

May 16, 2023

Filed

Jul 31, 2023

To disclose

11 weeks

Affected · nationwide

58,0344 in this filing

Linked

6 filings

Confidence

50%
Full breach record for Synergy Healthcare Services →

Synergy Healthcare Services, a healthcare organization, reported a data breach to the Maine Attorney General. The breach, described as an external system breach (hacking), occurred between November 30, 2022, and December 3, 2022, and was discovered on May 16, 2023. The breach affected 4 Maine residents, and the compromised information included names or other personal identifiers in combination with financial account numbers or credit/debit card numbers. Synergy Healthcare Services offered one year of credit monitoring services through Experian to affected individuals.

Maine clockDiscovered May 16, 2023 → Filed with AG Jul 31, 202376d ⏱ ME AG >30d11 weeks discovery → filing
⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 167 days
discovery → filing · 11 weeks / 76 days

Nov 30, 2022

Begins

May 16, 2023

Discovered

Jul 31, 2023

Filed

vs. sector median

on median

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Show 1 more filing ↓up to 10d gap

Filing propagation · 6 filings · 6 states

View merged incident ↗
Montana State AGJul 26 · first
Vermont State AG+1d
Indiana State AG+1d
HHS OCR+5d
Maine State AG+5d · this page
Massachusetts State AG+15d

Pattern: first filing Jul 26 (MT), last Aug 10 (MA) — a 15-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.