AccidentalHealthcareTechnologyHealthcareMisdeliveryData ExfiltratedCustomer Data InvolvedPHIHealth (basic)PIIIdentity (basic)MetadataLowContained

Propel Network

bd_28a7117f875513e9 · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

May 4, 2023

To disclose

—

Affected

2state residents only

Confidence

66%

Full breach record for Propel Network →

Propel Network dba Nurx notified Montana residents of a privacy incident where tracking technologies on its website impermissibly disclosed Protected Health Information (PHI) and other member data to third-party ad networks (Google, Meta, TikTok) between Nov 2021 and Dec 2022. Data included hashed names, emails, phone numbers, and medical condition info. Nurx ceased data sharing and updated its website workflow.

J jump to incidentP pin to compareR raw source

Incident timeline

Nov 1, 2021

Begins

May 4, 2023

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed2 affectedView incident

Name: Propel Network
norm: propel network
Domain: nurx.co

Name: Propel Network
norm: propel network
Domain: nurx.co
Also named: Propel Network, LLCdba oflegal entity
Nurxdba oftrade name
Industry: HealthcarellmTechnologyllm

Discovered: —
Breach occurred: Nov 1, 2021 – Dec 22, 2022
Materiality determined: —
Notification sent: Apr 20, 2023
Affected individuals: 2state-resident count only
Data types: PHIHealth (basic)PIIIdentity (basic)Metadata
Attack vector: Misconfiguration
MITRE ATT&CK: T1566.002 Spearphishing Link
Threat actor: External

During the incident: Launched an internal review to evaluate Nurx’s use and disclosure of member information
Updated the CVS member-specific website flow
Ceased all sharing of CVS member information with Third Parties in the Workflow
Working with Third Parties to ensure that proper contractual obligations are in place
Conducting comprehensive analysis of website and information disclosure practices
Changes made: Updated the CVS member-specific website flow
Ceased all sharing of CVS member information with Third Parties in the Workflow
Working with Third Parties to ensure that proper contractual obligations are in place where applicable to protect patient information
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-notification-letter-248.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 4, 2023
Raw hash: 9f9a4716722c0fa2daf2fd74276e6cc6e8cba852a48a4aa13095b9e3190560da

Reporting entityPropel Network

Victim entityPropel Network

IncidentMisconfiguration

Stated responseLaunched an internal review to evaluate Nurx’s use and disclosure of member information

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov