Social EngineeringTechnologyHealthcareInformationPhishingStolen CredentialsCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDPHIHealth (basic)HighContained

Vimly Benefit Solutions, Inc.

bd_33b843b68e1a6ce0 · schema v1 · pii pii-v1

Severity

High

Discovered

Aug 19, 2019

Filed

Dec 19, 2019

To disclose

17 weeks

Affected

91,807state residents only

Linked

6 filings

Confidence

69%

Full breach record for Vimly Benefit Solutions, Inc. →4 incidents on file

Vimly Benefit Solutions, a third-party administrator for employee benefit trusts, reported a phishing incident where unauthorized access to employee email accounts exposed PHI, SSNs, and PII of 91,807 Washington residents. Vimly engaged forensic investigators, secured accounts, and offered credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 3 days

discovery → filing · 17 weeks / 122 days

Aug 16, 2019

Begins

Aug 19, 2019

Discovered

Dec 19, 2019

Filed

vs. sector median

1 wks faster

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Montana State AGbd_1ad8d33ebbf7dc372019-12-19Verified
Oregon State AGbd_26e53675705704bb2019-12-19Verified
Massachusetts State AGbd_de7b7402e3b33b302019-12-19Verified
Massachusetts State AGbd_b14167d0f83898362019-12-18 · +1dVerified

Show 1 more filing ↓up to 6d gap

HHS OCRbd_1f5effa8566bca0d2019-12-13 · +6dVerified

Name: BAKER & HOSTETLER LLP
norm: baker hostetler

Name: Vimly Benefit Solutions, Inc.
norm: vimly benefit
Industry: TechnologyllmHealthcarellm

Discovered: Aug 19, 2019
Breach occurred: Aug 16, 2019 – Aug 21, 2019
Undetected for: 3 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 18, 2019
Affected individuals: 91,807state-resident count only
Data types: Identity (basic)Government IDPHIHealth (basic)
Data elements: NameSocial Security numberDate of birth
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 1-99dexposure 1-99d
WA-stated discovery: Found while ongoing
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid Accounts
Threat actor: External
Regulator citations: Notification to the Attorney General is done in compliance with Wash. Rev. Code § 19.255.010
Initial access: phishing_link

During the incident: Vimly immediately took steps to secure the email accounts and began an investigation
A leading cybersecurity firm was engaged to assist in the investigation
Vimly began mailing notification letters to the Washington residents potentially affected by this incident
Vimly is offering one year of complimentary credit monitoring, fraud consultation, and identity theft protection service through Kroll
Vimly has also established a dedicated call center where Trust participants may obtain more information regarding the incident
Changes made: Pursuing HITRUST certification as evidence of its commitment to security and privacy
Reviewing its email protocols and continuously enhancing its security
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 17 weeks(122 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 4 states

View merged incident ↗

HHS OCRDec 13 · first

Massachusetts State AG+5d

Montana State AG+6d

Oregon State AG+6d

Massachusetts State AG+6d

Washington State AG+6d · this page

Pattern: first filing Dec 13 (WA), last Dec 19 (WA) — a 6-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10525.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 19, 2019
Raw hash: 5f3a3641236a659ac6b2db93f3562b916fd825e43cb6712b15c585c23e09d934

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityBAKER & HOSTETLER LLP

Victim entityVimly Benefit Solutions, Inc.

Incidentdiscovered Aug 19, 2019

Stated responseVimly immediately took steps to secure the email accounts and began an investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com