HackingHealthcareInformationVulnerability ExploitZero-DayCustomer Data InvolvedGovernment IDIdentity (basic)MediumResolved

Nuance Communications, Inc

bd_2d18f75acad25ac9 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 10, 2023

Filed

Sep 15, 2023

To disclose

10 weeks

Affected

1state residents only

Linked

11 records

Confidence

50%

Full breach record for Nuance Communications, Inc →6 incidents on file

Nuance Communications, Inc. disclosed a data breach affecting one Maine resident, which occurred from May 28 to May 29, 2023. The breach was discovered on July 10, 2023, and was attributed to a zero-day vulnerability. The compromised data includes Social Security Numbers. Affected individuals were notified on September 22, 2023, and offered a 24-month membership to Equifax’s Credit Watch Gold for identity theft protection.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Jul 10, 2023 → Filed with AG Sep 15, 202367d ⏱ ME AG >30d10 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 43 days

discovery → filing · 10 weeks / 67 days

May 28, 2023

Begins

Jul 10, 2023

Discovered

Sep 15, 2023

Filed

vs. sector median

+1 wks slower

This filing is one of 11 records about the same incident.View merged incident

Part of Progress Software Corporation supply-chain incident (2023) — a supply-chain cascade affecting multiple organizations.View cascade →

A leak claim by cl0p about this victim was first seen 91 days before this filing.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitecl0pbd_40ea5b2a63ba1e582023-06-16 · +91dVerified by operator

Regulatory filings (9) · sorted by filing gap

New Hampshire State AGbd_42ba23005cabceb82023-09-15Verified
California State AGbd_829cc01dc8d0b7322023-09-15Verified
Washington State AGbd_82faba2aed5d0b312023-09-15Verified by operator
HHS OCRbd_cd3e342a18e72ccb2023-09-15Verified

Show 5 more filings ↓up to 257d gap

Montana State AGbd_f82949cd77b8e1ac2023-09-15Verified
Delaware State AGbd_119ca48980839f9b2023-09-18 · +3dVerified
Oregon State AGbd_61e841c1c65090342023-09-19 · +4dVerified
Illinois State AGbd_59fd556cb57cb64f2023-01-01 · +257dVerified by operator
Illinois State AGbd_6a436e30174844602023-01-01 · +257dVerified by operator

Name: Nuance Communications, Inc
norm: nuance communications
Domain: nuance.com

Name: Nuance Communications, Inc
norm: nuance communications
Domain: nuance.com
Industry: Healthcarellm

Discovered: Jul 10, 2023
Breach occurred: May 28, 2023 – May 29, 2023
Undetected for: 43 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 22, 2023
Affected individuals: 1state-resident count only
Data types: Government IDIdentity (basic)
Data elements: Social Security number
Attack vector: Unauthorized Access

Changes made: Offered 24-month membership to Equifax’s Credit Watch Gold
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 10 weeks(67 days from discovery to filing)
Compliance flags: ME AG >30d · 67dME resident >60d · 74dLeak >90d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Jul 10, 2023
→ Filed with AG: Sep 15, 2023
67d 30 days (soft) ME AG >30d
Maine
Discovered: Jul 10, 2023
→ Notified: Sep 22, 2023
74d 60 days (analyst band; statutory cap is 30 days) ME resident >60d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Jul 10, 2023 → Filed with AG: Sep 15, 2023	67d	30 days (soft)	ME AG >30d
Maine	Discovered: Jul 10, 2023 → Notified: Sep 22, 2023	74d	60 days (analyst band; statutory cap is 30 days)	ME resident >60d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 10 filings · 9 states

View merged incident ↗

Illinois State AGJan 1 · first

New Hampshire State AG+257d

California State AG+257d

Washington State AG+257d

HHS OCR+257d

Montana State AG+257d

Maine State AG+257d · this page

Delaware State AG+260d

Oregon State AG+261d

Pattern: first filing Jan 1 (IL), last Sep 19 (OR) — a 261-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/66187ace-3687-41c3-ab65-33363ae1f399.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 15, 2023
Raw hash: 5c2a6cf17c567e85ee57f24e1e20021c75275ef1ade4e8601e9bce3e105bba7c

Linked disclosures

Ransomware claims (1)

Regulatory filings (9) · sorted by filing gap

Reporting entityNuance Communications, Inc

Victim entityNuance Communications, Inc

Incidentdiscovered Jul 10, 2023

Stated responseOffered 24-month membership to Equifax’s Credit Watch Gold

ComplianceME AG >30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov