HackingHealthcareTechnologyHealthcareStolen CredentialsData ExfiltratedCustomer Data InvolvedBusiness Associate (HIPAA)PHIIdentity (basic)Government IDHealth (basic)Financial accountMinorMediumContained

Connexin Software, Inc.

bd_1714e873907ffbd7 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 26, 2022

Filed

Nov 14, 2022

To disclose

11 weeks

Affected

Not disclosed

Linked

7 filings

Confidence

65%

Full breach record for Connexin Software, Inc. →2 incidents on file

Connexin Software, Inc. detected a data anomaly on August 26, 2022, leading to the discovery that an unauthorized party accessed offline patient data on July 17, 2022. Some data was removed. Affected data includes PHI, SSNs, and health insurance info for patients, including minors. Connexin engaged forensics, reset passwords, and offered identity monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 40 days

discovery → filing · 11 weeks / 80 days

Jul 17, 2022

Begins

Aug 26, 2022

Discovered

Nov 14, 2022

Filed

vs. sector median

1 wks faster

This filing is one of 7 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

Oregon State AGbd_5b34d1b03ca82c402022-11-14Verified
Montana State AGbd_a2703f9eb481b2012022-11-14Verified
South Carolina State AGbd_a4c6d762fac543f52022-11-14Verified
HHS OCRbd_fd18f9fae5f5fe0a2022-11-11 · +3dVerified

Show 2 more filings ↓up to 14d gap

Massachusetts State AGbd_ba794324e12990b22022-11-28 · +14dVerified
New Hampshire State AGbd_d5db1475a509da852022-11-28 · +14dVerified

Name: Connexin Software, Inc.
norm: connexin software

Name: Connexin Software, Inc.
norm: connexin software
Industry: HealthcarellmTechnologyllm

Discovered: Aug 26, 2022
Breach occurred: Jul 17, 2022
Undetected for: 40 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: PHIIdentity (basic)Government IDHealth (basic)Financial accountMinor
Data elements: Social Security numberDate of birthMedical information
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
Threat actor: External

During the incident: Launched an investigation
Engaged third-party forensic experts
Took action to stop the unauthorized activity
Password reset of all corporate accounts
Moving all patient data used for data conversion and troubleshooting into an environment with even greater security
Retained a third-party cybersecurity forensic firm to investigate the issue
Working with law enforcement to investigate the incident
Offering identity monitoring services for a period of one year, at no cost, through Kroll
Changes made: Enhanced its security and monitoring
Further hardened its systems as appropriate to minimize the risk of any similar incident in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 11 weeks(80 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 7 states

View merged incident ↗

HHS OCRNov 11 · first

Oregon State AG+3d

Montana State AG+3d

South Carolina State AG+3d

California State AG+3d · this page

Massachusetts State AG+17d

New Hampshire State AG+17d

Pattern: first filing Nov 11 (PA), last Nov 28 (NH) — a 17-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-559176
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 14, 2022
Raw hash: 0ef27329a38788eb94d3127b5e06726e16b94fa21f53eca46df56d685b617959

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityConnexin Software, Inc.

Victim entityConnexin Software, Inc.

Incidentdiscovered Aug 26, 2022

Stated responseLaunched an investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov