HackingHealthcareOtherHealthcareStolen CredentialsTargetedData ExfiltratedIdentity (basic)Government IDFinancial accountHealth (basic)PIIMediumContained

Heartland Alliance

bd_20a1841af7afcb62 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 1, 2022

Filed

Dec 15, 2022

To disclose

50 weeks

Affected

3state residents only

Linked

8 filings

Confidence

66%

Full breach record for Heartland Alliance →

Heartland Alliance notified Montana residents of a data security incident discovered in late January 2022. Unauthorized access to IT systems may have exposed names, SSNs, driver's licenses, bank account numbers, and for some, medical/dental records. The FBI was notified. Free credit monitoring is offered.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 50 weeks / 348 days

Jan 1, 2022

Discovered

Dec 15, 2022

Filed

vs. sector median

+37 wks slower

This filing is one of 8 about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitesuncryptbd_1a3971abe2a982d02022-02-08 · +310dVerified by operator

Regulatory filings (6) · sorted by filing gap

Indiana State AGbd_3c5fa381cd03cff22022-12-15Verified
Maine State AGbd_23693f388b81a2c92022-12-19 · +4dVerified by operator
New Hampshire State AGbd_31e23de4816652062022-12-20 · +5dVerified by operator
Massachusetts State AGbd_963896305dc6be8e2022-12-20 · +5dVerified by operator

Show 2 more filings ↓up to 37d gap

Illinois State AGbd_55fec449238b07222023-01-01 · +17dVerified
HHS OCRbd_b0e2c2a30977a5c82022-11-08 · +37dCandidate

Name: Heartland Alliance
norm: heartland alliance

Name: Heartland Alliance
norm: heartland alliance
Industry: HealthcarellmOtherllm

Discovered: Jan 1, 2022
Materiality determined: —
Notification sent: Dec 15, 2022
Affected individuals: 3state-resident count only
Data types: Identity (basic)Government IDFinancial accountHealth (basic)PII
Data elements: Social Security numberDate of birthMedical information
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: reported the incident to the Federal Bureau of Investigation
Initial access: valid_credentials

During the incident: Secured the system
Hired a leading cybersecurity firm to investigate
Added new security features to our IT systems
Reported the incident to the Federal Bureau of Investigation
Changes made: Added new security features to our IT systems to reduce the risk of something like this happening again
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 50 weeks(348 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 6 states

View merged incident ↗

HHS OCRNov 8 · first

Indiana State AG+37d

Montana State AG+37d · this page

Maine State AG+41d

New Hampshire State AG+42d

Massachusetts State AG+42d

Illinois State AG+54d

Pattern: first filing Nov 8 (IL), last Jan 1 (IL) — a 54-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-Notification-85.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 15, 2022
Raw hash: e39d0d30fddb11fc188c062eb2fe526f4fde2ca6faa9277a162fbb2bc9cde3c4

Linked disclosures

Ransomware claims (1)

Regulatory filings (6) · sorted by filing gap

Reporting entityHeartland Alliance

Victim entityHeartland Alliance

Incidentdiscovered Jan 1, 2022

Stated responseSecured the system

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov