HackingTechnologyHealthcareInformationVulnerability ExploitZero-DayTargetedIdentity (basic)LowContained

Insightin Health

bd_35cace97c849afa2 · schema v1 · pii pii-v1

Severity

Low

Discovered

Sep 1, 2025

Filed

Jan 28, 2026

To disclose

21 weeks

Affected

Not disclosed

Linked

12 filings

Confidence

66%

Full breach record for Insightin Health →2 incidents on file

Insightin Health, Inc. notified consumers of a security incident in September 2025 where an unauthorized actor exploited a previously unknown vulnerability in a third-party application to access the network. Files containing names were accessed between Sept 17-23, 2025. Insightin engaged forensic specialists, reported to law enforcement, and offers 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Vermont clock✗ VT AG >45 bday21 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

Sep 17, 2025

Begins

Jan 28, 2026

Filed

vs. sector median

+3 wks slower

This filing is one of 12 about the same incident.View merged incident

A leak claim by medusa about this victim predates this filing by 127 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitemedusabd_5735d224535af4252025-09-26 · +123dVerified by operator

Regulatory filings (9) · sorted by filing gap

HHS OCRbd_f9dc8500fdfbdf8c2026-01-16 · +12dVerified
Vermont State AGbd_30942dbf93d1eb242026-03-04 · +35dVerified by operator
Montana State AGbd_d26a3eeabbd32ef72026-03-04 · +35dVerified
Washington State AGbd_17bef6ae03a1347e2026-03-05 · +36dVerified by operator

Show 5 more filings ↓up to 63d gap

Oregon State AGbd_3070c615628a95182026-03-05 · +36dVerified
California State AGbd_3bdd8091c9b79d352026-03-05 · +36dVerified by operator
Texas State AGbd_d1b693a2d4ddee3f2026-03-10 · +41dVerified
California State AGbd_7fc85ada2e1884b92026-04-01 · +63dVerified by operator
Vermont State AGbd_9a2bd835940a41492026-04-01 · +63dVerified by operator

Showing first 10 of 11 linked disclosures.

Name: Insightin Health
norm: insightin health
Domain: insightinhealth.com

Name: Insightin Health
norm: insightin health
Domain: insightinhealth.com
Industry: TechnologyllmHealthcarellm

Discovered: Sep 1, 2025
Breach occurred: Sep 17, 2025 – Sep 23, 2025
Materiality determined: Jan 28, 2026
Notification sent: Jan 28, 2026
Affected individuals: Not disclosed
Data types: Identity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: External
Regulator citations: reported this incident to law enforcement and regulators
Initial access: exploit_public_facing

During the incident: Launched an investigation with the assistance of third-party forensic specialists
Remediated to prevent the potential for ongoing access
Reported this incident to law enforcement and regulators
Offering you complimentary access to twelve (12) months of credit monitoring through Cyberscout, a TransUnion company
Changes made: Reviewed existing security policies
Implemented additional measures to further protect against similar incidents moving forward
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 21 weeks(149 days from discovery to filing)
Compliance flags: VT AG >45 bdayLeak >90d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 10 filings · 7 states

View merged incident ↗

HHS OCRJan 16 · first

Vermont State AG+12d · this page

Vermont State AG+47d

Montana State AG+47d

Washington State AG+48d

Oregon State AG+48d

California State AG+48d

Texas State AG+53d

California State AG+75d

Vermont State AG+75d

Pattern: first filing Jan 16 (MD), last Apr 1 (VT) — a 75-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Cascade drawn from the first 10 linked disclosures of 11 — the full spread may be wider.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ago.vermont.gov/document/2026-01-28-insightin-health-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 28, 2026
Raw hash: e4da4a19f3fd579debe0020dc5b5d737a8b68c7557ad147c57c8f03a211c3a2e

Linked disclosures

Ransomware claims (1)

Regulatory filings (9) · sorted by filing gap

Reporting entityInsightin Health

Victim entityInsightin Health

Incidentdiscovered Sep 1, 2025

Stated responseLaunched an investigation with the assistance of third-party forensic specialists

ComplianceVT AG >45 bday

Extraction provenanceno artifact recorded

Source provenanceago.vermont.gov