AccidentalHealthcareHealthcareMisdeliveryCustomer Data InvolvedPHIIdentity (basic)LowResolved

K2 Psych Services

bd_2ebc26be349eff3c · schema v1 · pii pii-v1

Severity

Low

Discovered

Jan 31, 2025

Filed

Feb 3, 2025

To disclose

3 days

Affected

941

Confidence

66%

Full breach record for K2 Psych Services →

K2 Psych Services experienced a data breach on January 31, 2025, when an email titled 'Alignable Issue/Request' was mistakenly sent without blind copying recipients. This inadvertently exposed the email addresses and potentially linked names of 941 contacts, including up to 207 current or past clients. The incident involved the misdelivery of private health information (PHI). The organization notified affected individuals, deactivated the associated Alignable account, and is implementing enhanced security measures.

J jump to incidentP pin to compareR raw source

Maryland clock✓ MD AG ≤30d3 days discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 3 days

Jan 31, 2025

Begins

Jan 31, 2025

Discovered

Feb 3, 2025

Filed

vs. sector median

12 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed941 affectedView incident

Name: K2 Psych Services
norm: k2 psych
Domain: k2psychservices.com

Name: K2 Psych Services
norm: k2 psych
Domain: k2psychservices.com
Industry: Healthcarellm

Discovered: Jan 31, 2025
Breach occurred: Jan 31, 2025
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 31, 2025
Affected individuals: 941nationwide
Data types: PHIIdentity (basic)
Attack vector: Unknown

During the incident: Sent an email to the list of clients notifying them of breach of private health information and included steps to follow
Deleted access within the Alignable app/account to my Google Workspace contacts
De-activated the Alignable account
Deleted the address book in Alignable
Changes made: Implementing advanced security measures to ensure the protection of private health information, including enhanced data encryption
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 3 days(3 days from discovery to filing)
Compliance flags: MD AG ≤30d
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.maryland.gov/resources-info/SBN%20Documents/2025/ITU-376291.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 3, 2025
Raw hash: 57a147de073245121cb1d08499f56b967e402717e069f826846db4df4eaf8895

Reporting entityK2 Psych Services

Victim entityK2 Psych Services

Incidentdiscovered Jan 31, 2025

Stated responseSent an email to the list of clients notifying them of breach of private health information and included steps to follow

ComplianceMD AG ≤30d

Extraction provenanceno artifact recorded

Source provenanceoag.maryland.gov