MalwareHealthcareFinancial ServicesHealthcareRansomwareData ExfiltratedData EncryptedCustomer Data InvolvedIdentity (basic)MediumContained

Horizon Healthcare RCM

bd_2c30bdb47fb3604a · schema v1 · pii pii-v1

Severity

Medium

Discovered

Dec 27, 2024

Filed

Jun 27, 2025

To disclose

26 weeks

Affected

9,672state residents only

Linked

8 filings

Confidence

63%

Full breach record for Horizon Healthcare RCM →2 incidents on file

Horizon Healthcare RCM, a former revenue-cycle management company, issued a supplemental notice regarding a December 2024 ransomware incident. A computer virus encrypted files and data was copied between Dec 26-27, 2024. The incident affected patient information (names and other data elements) of individuals who received services from a former Horizon customer. Horizon restored systems, arranged for data deletion by the attacker, and provided complimentary Kroll identity monitoring.

J jump to incidentP pin to compareR raw source

South Carolina clock✓ SC CRA notice due26 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 1 days

discovery → filing · 26 weeks / 182 days

Dec 26, 2024

Begins

Dec 27, 2024

Discovered

Jun 27, 2025

Filed

vs. sector median

+14 wks slower

This filing is one of 8 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (7) · sorted by filing gap

HHS OCRbd_2494d37011c4c79c2025-06-27Verified
Indiana State AGbd_25fcf4be90ea13492025-06-27Verified
Nebraska State AGbd_683236bfcdb2a0902025-06-27Verified
Massachusetts State AGbd_8ff54dbb0d7f4d762025-06-27Verified

Show 3 more filings ↓up to 4d gap

New Hampshire State AGbd_a3ed180e1ba972d72025-06-27Verified
Maine State AGbd_b9ed9343a285ba772025-06-27Verified
Illinois State AGbd_5a1984ac023e4ba82025-07-01 · +4dVerified

Name: Horizon Healthcare RCM
norm: horizon healthcare rcm

Name: Horizon Healthcare RCM
norm: horizon healthcare rcm
Industry: HealthcarellmFinancial Servicesllm

Discovered: Dec 27, 2024
Breach occurred: Dec 26, 2024 – Dec 27, 2024
Undetected for: 1 dayoccurrence → discovery
Materiality determined: Sep 23, 2025
Notification sent: Sep 23, 2025
Affected individuals: 9,672state-resident count only
Data types: Identity (basic)
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notice has not been delayed by law enforcement

During the incident: Arranged for the party responsible for this matter to delete the copied information
Securely restored our systems
Providing free resources and guidance
Secured the services of Kroll to provide identity monitoring
Implemented additional technical measures and processes to further enhance the company’s security
Changes made: Implemented additional technical measures and processes to further enhance the company’s security
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 26 weeks(182 days from discovery to filing)
Compliance flags: SC CRA notice due
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 7 states

View merged incident ↗

HHS OCRJun 27 · first

Indiana State AGJun 27 · first

Nebraska State AGJun 27 · first

Massachusetts State AGJun 27 · first

New Hampshire State AGJun 27 · first

Maine State AGJun 27 · first

South Carolina State AGJun 27 · first · this page

Illinois State AG+4d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/Notification%20Letter%20to%20Consumer%20Supplemental.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 27, 2025
Raw hash: 7bed5253c864b2135f198317ae37657a343dedc7e2947f2481199d691d403523

Linked disclosures

Regulatory filings (7) · sorted by filing gap

Reporting entityHorizon Healthcare RCM

Victim entityHorizon Healthcare RCM

Incidentdiscovered Dec 27, 2024

Stated responseArranged for the party responsible for this matter to delete the copied information

ComplianceSC CRA notice due

Extraction provenanceno artifact recorded

Source provenanceconsumer.sc.gov