HackingStolen CredentialsCustomer Data InvolvedDelayed DiscoveryIDENTITY_BASICIDENTITY_GOVERNMENTHighContained
AllOne Health
bd_28c3320a69776d4a · schema v1 · pii pii-v1
Full breach record for AllOne Health →AllOne Health, a healthcare organization, reported a data breach resulting from unauthorized access to an employee's email account. The breach occurred between September 1, 2021, and February 11, 2022, and was discovered on March 23, 2022. The incident affected 13,669 individuals, compromising their names and Social Security numbers. AllOne Health offered affected individuals one year of complimentary identity protection and credit monitoring services through Epiq.
Maine clockDiscovered Mar 23, 2022 → Filed with AG Jul 18, 2022117d ✗ ME AG >90d17 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
This filing is one of 3 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (2) · sorted by filing gap
- bd_bcfc378c255f1fbfMontana State AGfiled 2022-07-18Verified by operator
- bd_371e79b979ca9990California State AGfiled 2022-07-20(2d gap)Verified
Source provenance
- Source URL
- https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/dbd392b2-d013-4c88-88be-bad1d7e24fbf.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jul 18, 2022
- Raw hash
- 7c1e4a9e1b98c8f37c328cad6d0b9fff9e5a10e5d86b0bc7437e6bbd9f6a8670
Reporting entity
- Name
- COZEN O'CONNORnorm: cozen o connor
Victim entity
- Name
- AllOne Healthnorm: allone health
- Domain
- allonehealth.com
- Industry
- Healthcare
Incident
- Discovered
- Mar 23, 2022
- Materiality determined
- —
- Notification sent
- Jul 15, 2022
- Affected individuals
- 13,669
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENT
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1078 Valid AccountsT1114 Email Collection
- Threat actor
- External
- Initial access
- valid_credentials
Compliance
- Time to disclose
- 17 weeks(117 days from discovery to filing)
- Compliance flags
- ME AG >90d · 117dME resident >60d · 114d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
- Clock breakdown
Statute Window Elapsed Threshold Status Maine Discovered: Mar 23, 2022→ Filed with AG: Jul 18, 2022117d 90 days ME AG >90d Maine Discovered: Mar 23, 2022→ Notified: Jul 15, 2022114d 60 days (analyst band; statutory cap is 30 days) ME resident >60d
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.