HackingHealthcareData ExfiltratedCustomer Data InvolvedIDENTITY_GOVERNMENTIDENTITY_BASICCriticalContained
BrightSpring Health Services
bd_3062db7084316827 · schema v1 · pii pii-v1
Full breach record for BrightSpring Health Services →BrightSpring Healthcare Services, Inc. reported an external system breach (hacking) occurring March 12-13, 2023, discovered May 20, 2023. The incident affected 535,203 individuals, including 547 Maine residents. Acquired data included names and Social Security Numbers. BrightSpring provided 12 months of credit monitoring services through Kroll.
Maine clockDiscovered May 20, 2023 → Filed with AG Aug 11, 202383d ⏱ ME AG >30d12 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
This filing is one of 7 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (6) · sorted by filing gap
- bd_2a1df99c2cf14cfaNew Hampshire State AGfiled 2023-08-11Verified
- bd_3aa20233dfaa9087Washington State AGfiled 2023-08-11Verified
- bd_7e1fd6f523ea99c0Vermont State AGfiled 2023-08-11Verified
- bd_803064993091323cCalifornia State AGfiled 2023-08-11Verified
Show 2 more filings ↓Show fewer ↑up to 1d gap
- bd_fc74412ffcf6b2daOregon State AGfiled 2023-08-11Verified
- bd_cc3e2c51c1917a14Montana State AGfiled 2023-08-10(1d gap)Candidate
Source provenance
- Source URL
- https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/fd59425f-32ac-4148-96c9-8b499fc04f55.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Aug 11, 2023
- Raw hash
- cb6b4f109ed523a58141229c5e3dede9b95289cfca2b038249ab417614616b79
Reporting entity
- Name
- BrightSpring Health Servicesnorm: brightspring health
Victim entity
- Name
- BrightSpring Health Servicesnorm: brightspring health
Incident
- Discovered
- May 20, 2023
- Materiality determined
- —
- Notification sent
- Aug 11, 2023
- Affected individuals
- 535,203
- Data types
- IDENTITY_GOVERNMENTIDENTITY_BASIC
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1190 Exploit Public-Facing Application
- Threat actor
- External
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 12 weeks(83 days from discovery to filing)
- Compliance flags
- ME AG >30d · 83dME resident >60d · 83d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
- Clock breakdown
Statute Window Elapsed Threshold Status Maine Discovered: May 20, 2023→ Filed with AG: Aug 11, 202383d 30 days (soft) ME AG >30d Maine Discovered: May 20, 2023→ Notified: Aug 11, 202383d 60 days (analyst band; statutory cap is 30 days) ME resident >60d
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.