HackingHealthcareFinancial ServicesHealthcareSupply Chain (3P Vendor)Customer Data InvolvedPIIPHILowContained

KNIGHTS OF COLUMBUS

bd_2a9c65bd7e22a8c6 · schema v1 · pii pii-v1

Severity

Low

Discovered

May 4, 2026

Filed

Jul 10, 2026

To disclose

—

Affected

Not disclosed

Linked

4 filings

Confidence

68%

Full breach record for KNIGHTS OF COLUMBUS →2 incidents on file

AutoAPS, LLC, a third-party medical record retrieval vendor for Knights of Columbus, notified the organization on May 4, 2026, of suspicious activity detected in its hosting network on December 25, 2025. A forensic investigation could not confirm data access. AutoAPS offered IDX identity protection services to affected individuals. The incident involves PHI and PII via a third-party supply chain compromise.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 130 days

Dec 25, 2025

Begins

May 4, 2026

Discovered

Jul 10, 2026

Filed

This filing is one of 4 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Indiana State AGbd_6381af49b9d370a22026-07-10Verified
Massachusetts State AGbd_cf4153e6766c775f2026-08-03 · +24dVerified
New Hampshire State AGbd_e802c7cf47af73c72026-08-10 · +31dVerified

Name: AutoAPS, LLC
norm: autoaps

Name: KNIGHTS OF COLUMBUS
norm: knights of columbus
Industry: HealthcarellmFinancial Servicesllm

Discovered: May 4, 2026
Breach occurred: Dec 25, 2025
Undetected for: 130 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: PIIPHI
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain Compromise
Threat actor: External
Initial access: supply_chain

During the incident: Vendor reported it immediately took steps to contain and remediate the incident
Initiated a forensic investigation with the assistance of a cybersecurity firm
Conducted a comprehensive review and analysis of the data present in the environment
Offering a complimentary membership to identity protection services through IDX
Adopt additional safeguards to strengthen security, including implementing various hardening measures and increasing access controls
Changes made: Adopt additional safeguards to strengthen security
Implementing various hardening measures
Increasing access controls
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Indiana State AGJul 10 · first

Nebraska State AGJul 10 · first · this page

Massachusetts State AG+24d

New Hampshire State AG+31d

Pattern: first filing Jul 10 (IN), last Aug 10 (NH) — a 31-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://nebraska.gov/ago/data-breach/documents/d6f307da-fcd0-49c2-a84e-53ce0e80ebab.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 10, 2026
Raw hash: ad249aadff8f688750728ea410f7526c8a6c7a5eedd6a0455781f8e98e6967a3

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityAutoAPS, LLC

Victim entityKNIGHTS OF COLUMBUS

Incidentdiscovered May 4, 2026

Stated responseVendor reported it immediately took steps to contain and remediate the incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancenebraska.gov