Social EngineeringHealthcareTechnologyHealthcarePhishingCustomer Data InvolvedTargetedIdentity (basic)Health (basic)PHIMediumContained

Outcomes

bd_25a352c6de9ebeff · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 1, 2025

Filed

Sep 23, 2025

To disclose

12 weeks

Affected

3,477state residents only

Linked

8 filings

Confidence

71%

Full breach record for Outcomes →

Outcomes One, Inc. reported a phishing incident on July 1, 2025, affecting one employee's email account. Unauthorized access occurred for approximately one hour. Data accessed included names, medical provider names, health insurance info, and medication info for 3,477 Washington residents (Aetna Health Insurance Company members). Notification sent September 23, 2025.

J jump to incidentP pin to compareR raw source

Washington clock⏱ WA AG >30d12 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 12 weeks / 84 days

Jul 1, 2025

Begins

Jul 1, 2025

Discovered

Sep 23, 2025

Filed

vs. sector median

1 wks faster

This filing is one of 8 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (7) · sorted by filing gap

California State AGbd_30e22ddaec24070e2025-09-23Verified
Oregon State AGbd_a6e85691ffe67ace2025-09-23Verified
HHS OCRbd_bfd803f20d5ab6cd2025-09-23Verified
Montana State AGbd_d5b332c2531136fb2025-09-23Verified

Show 3 more filings ↓up to 31d gap

Illinois State AGbd_03571164f9cb676a2025-09-01 · +22dCandidate
California State AGbd_1534c283b261f9d62025-10-23 · +30dVerified
Texas State AGbd_a6f792d784d84ba32025-10-24 · +31dVerified

Name: Outcomes
norm: outcomes
Domain: outcomes.com

Name: Outcomes
norm: outcomes
Domain: outcomes.com
Industry: HealthcarellmTechnologyllm

Discovered: Jul 1, 2025
Breach occurred: Jul 1, 2025
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 23, 2025
Affected individuals: 3,477state-resident count only
Data types: Identity (basic)Health (basic)PHI
Data elements: NameHealth insurance IDMedical information
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 0dexposure 0d
WA-stated discovery: Found while ongoingContained same day
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Regulator citations: Notified Washington Attorney General
Initial access: phishing_link

During the incident: Took affected email account secure
Engaged third-party specialists to help investigate the matter
Started notifying the data owners of the incident
Provided a toll-free call center to answer any questions
Changes made: Added and will continue to evaluate enhanced safeguards and security measures to further protect its email system
Added enhanced employee training regarding phishing emails
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 12 weeks(84 days from discovery to filing)
Compliance flags: WA AG >30d
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 7 states

View merged incident ↗

Illinois State AGSep 1 · first

California State AG+22d

Oregon State AG+22d

HHS OCR+22d

Montana State AG+22d

Washington State AG+22d · this page

California State AG+52d

Texas State AG+53d

Pattern: first filing Sep 1 (IL), last Oct 24 (TX) — a 53-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34728.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 23, 2025
Raw hash: 28e38f1952789835f49cc6246ff1cbc09c8bac6beb77fbed9889da1ab71c19cc

Linked disclosures

Regulatory filings (7) · sorted by filing gap

Reporting entityOutcomes

Victim entityOutcomes

Incidentdiscovered Jul 1, 2025

Stated responseTook affected email account secure

ComplianceWA AG >30d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com