HackingHealthcareHealthcareCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDHealth (basic)PHIMediumContained

Therapeutic Health Services

bd_3160e87da8cd1460 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 26, 2024

Filed

Jul 18, 2024

To disclose

20 weeks

Affected

Not disclosed

Linked

12 records

Confidence

67%

Full breach record for Therapeutic Health Services →

Therapeutic Health Services notified consumers on July 18, 2024, of a network compromise identified on February 26, 2024. Unauthorized activity potentially exposed names, SSNs, DOBs, and medical/health information. THS secured the network, engaged forensic experts, notified law enforcement, and offered credit monitoring. No evidence of misuse was found at the time of notice.

J jump to incidentP pin to compareR raw source

Vermont clock✗ VT AG >45 bday20 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

discovery → filing · 20 weeks / 143 days

Feb 26, 2024

Discovered

Jul 18, 2024

Filed

vs. sector median

+11 wks slower

This filing is one of 12 records about the same incident.View merged incident

A leak claim by hunters_international about this victim was first seen 121 days before this filing.View originating leak claim

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

Montana State AGbd_793062f3ad804d272024-07-18Verified
Maine State AGbd_0b0839c7602e26eb2024-07-19 · +1dVerified by operator
Massachusetts State AGbd_76c95b587b2d6ea42024-07-19 · +1dVerified by operator
Indiana State AGbd_9f2b9b64c727f93a2024-07-19 · +1dVerified by operator

Show 6 more filings ↓up to 105d gap

California State AGbd_db7590df7889e1192024-07-19 · +1dVerified by operator
New Hampshire State AGbd_5fa83b73c13ad3b92024-07-23 · +5dVerified by operator
Washington State AGbd_f491b2810a3b9c5c2024-07-11 · +7dVerified
HHS OCRbd_b12268e09d53b7412024-04-25 · +84dVerified
New Hampshire State AGbd_ed78a3330b539efb2024-10-30 · +104dVerified
Oregon State AGbd_1e7c1a6bf43c0ed92024-10-31 · +105dVerified by operator

Showing first 10 of 11 linked disclosures.

Name: Therapeutic Health Services
norm: therapeutic health
Domain: ths-wa.org

Name: Therapeutic Health Services
norm: therapeutic health
Domain: ths-wa.org
Industry: Healthcarellm

Discovered: Feb 26, 2024
Materiality determined: —
Notification sent: Jul 18, 2024
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDHealth (basic)PHI
Data elements: Date of birthMedical information
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Regulator citations: Notified law enforcement
Initial access: exploit_public_facing

During the incident: Secured and remediated the compromise
Engaged additional third-party experts
Hardened and enhanced data security
Commenced an investigation
Notified law enforcement
Arranged for complimentary credit monitoring and identity restoration services
Changes made: Enhanced cyber preparedness through additional awareness training
Updating procedures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 20 weeks(143 days from discovery to filing)
Compliance flags: VT AG >45 bdayLeak >90d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 9 states

View merged incident ↗

HHS OCRApr 25 · first

Washington State AG+77d

Montana State AG+84d

Vermont State AG+84d · this page

Maine State AG+85d

Massachusetts State AG+85d

Indiana State AG+85d

California State AG+85d

New Hampshire State AG+89d

New Hampshire State AG+188d

Oregon State AG+189d

Pattern: first filing Apr 25 (WA), last Oct 31 (OR) — a 189-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Cascade drawn from the first 10 linked disclosures of 11 — the full spread may be wider.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ago.vermont.gov/document/2024-07-18-therapeutic-health-services-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 18, 2024
Raw hash: a07e370566fd8ed6ab569e528808e79ccfb9dc79f383d1eb33e6c0fb9a65a408

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entityTherapeutic Health Services

Victim entityTherapeutic Health Services

Incidentdiscovered Feb 26, 2024

Stated responseSecured and remediated the compromise

ComplianceVT AG >45 bday

Extraction provenanceno artifact recorded

Source provenanceago.vermont.gov