AccidentalHealthcareFinancial ServicesHealthcareData Entry ErrorCustomer Data InvolvedPHIHealth (basic)Identity (basic)MediumResolved

Dental Health Services

bd_31f4d4ded3c7db8a · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 7, 2024

Filed

Apr 4, 2024

To disclose

8 weeks

Affected

1,778state residents only

Linked

4 filings

Confidence

70%

Full breach record for Dental Health Services →

Dental Health Services, Inc. disclosed unauthorized access to PHI due to a data entry error in its invoicing software. On Jan 25, 2024, incorrect invoices containing names, DOBs, and plan details were emailed to 13 recipients across 10 groups. Discovered Feb 7, 2024. 1,778 Washington residents affected. No evidence of misuse. Remediation included code modifications and access control changes.

J jump to incidentP pin to compareR raw source

Washington clock⏱ WA AG >30d8 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 13 days

discovery → filing · 8 weeks / 57 days

Jan 25, 2024

Begins

Feb 7, 2024

Discovered

Apr 4, 2024

Filed

vs. sector median

4 wks faster

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

California State AGbd_ab475130a7b32d822024-04-04Verified
HHS OCRbd_9d630839d595904c2024-04-16 · +12dVerified
HHS OCRbd_a62c51fbe88dd4ee2024-04-16 · +12dVerified

Name: John S Conniff, PLLC
norm: john s conniff

Name: Dental Health Services
norm: dental health
Domain: dentalhealthservices.com
Industry: HealthcarellmFinancial Servicesllm

Discovered: Feb 7, 2024
Breach occurred: Jan 25, 2024
Undetected for: 13 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 1,778state-resident count only
Data types: PHIHealth (basic)Identity (basic)
Data elements: NameDate of birthHealth insurance ID
WA-stated cause: Unauthorized Access
WA-stated duration: lifecycle 1-99dexposure 0d
WA-stated discovery: Found after the fact
Attack vector: Unknown
MITRE ATT&CK: T1119 Automated Collection
Regulator citations: Notified Office of the Attorney GeneralOther regulatory agencies will be notified as required by law

During the incident: Launched an investigation
Reviewed the software programming and debugged the software errors
Modified the software code of the invoicing application to create additional safeguards
Changed relevant software access and permissions
Sent notification letters to affected members
Changes made: Modified software code to create additional safeguards preventing incorrect invoicing
Implemented verification process to flag invoicing errors before completion
Changed software access and permissions to reduce risk of error by untrained staff
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(57 days from discovery to filing)
Compliance flags: WA AG >30d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 2 states

View merged incident ↗

California State AGApr 4 · first

Washington State AGApr 4 · first · this page

HHS OCR+12d

Pattern: first filing Apr 4 (CA), last Apr 16 (WA) — a 12-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA28513.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 4, 2024
Raw hash: 69bbc16bf5fa94da85764555e267155d499ff6bd6d11b15b7374d6f45abd674a

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityJohn S Conniff, PLLC

Victim entityDental Health Services

Incidentdiscovered Feb 7, 2024

Stated responseLaunched an investigation

ComplianceWA AG >30d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com