AccidentalHealthcareTechnologyHealthcareMisdeliveryCustomer Data InvolvedIdentity (basic)Government IDPHIHealth (basic)MediumContained

Zomo Health: Employee Wellness & Productivity Solutions

bd_283a63d9c2f8e404 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 5, 2022

Filed

Sep 29, 2022

To disclose

8 weeks

Affected

21state residents only

Confidence

65%

Full breach record for Zomo Health: Employee Wellness & Productivity Solutions →

Zomo Health, LLC notified Montana residents of a security incident where a spreadsheet containing plan member information was inadvertently made accessible via its website from January 15, 2022, to August 5, 2022. The data included names, DOBs, SSNs, and health plan details. Zomo secured the file, remediated the error, and engaged external security firms. Affected individuals received 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 202 days

discovery → filing · 8 weeks / 55 days

Jan 15, 2022

Begins

Aug 5, 2022

Discovered

Sep 29, 2022

Filed

vs. sector median

3 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed21 affectedView incident

Name: Zomo Health: Employee Wellness & Productivity Solutions
norm: zomo health employee wellness productivity
Domain: zomohealth.com

Name: Zomo Health: Employee Wellness & Productivity Solutions
norm: zomo health employee wellness productivity
Domain: zomohealth.com
Industry: HealthcarellmTechnologyllm

Discovered: Aug 5, 2022
Breach occurred: Jan 15, 2022 – Aug 5, 2022
Undetected for: 202 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 29, 2022
Affected individuals: 21state-resident count only
Data types: Identity (basic)Government IDPHIHealth (basic)
Data elements: Date of birth
Attack vector: Misconfiguration
MITRE ATT&CK: T1119 Automated Collection

During the incident: Secured the spreadsheet and its contents
Remediated the process vulnerability that led to the error
Engaged an external security company to enhance the security of our technology systems on an ongoing basis
Contracted with Equifax to provide you a complimentary, 12-month membership to Equifax Credit Watch
Changes made: Remediated the process vulnerability that led to the error
Engaged an external security company to enhance the security of our technology systems on an ongoing basis
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(55 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-Notification-Letter-590.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 29, 2022
Raw hash: a5fcd1a5a0323f9d4432a717c9d7178a360e3bdb962947287051ba9245e999d1

Reporting entityZomo Health: Employee Wellness & Productivity Solutions

Victim entityZomo Health: Employee Wellness & Productivity Solutions

Incidentdiscovered Aug 5, 2022

Stated responseSecured the spreadsheet and its contents

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov