HackingHealthcareTechnologyHealthcareSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)Government IDHealth (basic)PHIMediumContained

Avem Health Partners

bd_37db119ecbd2738a · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 16, 2022

Filed

Dec 13, 2022

To disclose

30 weeks

Affected

14state residents only

Linked

4 filings

Confidence

66%

Full breach record for Avem Health Partners →

Avem Health Partners notified Montana residents of a data security incident involving third-party vendor 365 Data Centers. Unauthorized access to servers occurred prior to May 14, 2022. Compromised data included names, DOB, SSNs, driver's licenses, and PHI. Avem offered one year of Experian IdentityWorks.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 2 days

discovery → filing · 30 weeks / 211 days

May 14, 2022

Begins

May 16, 2022

Discovered

Dec 13, 2022

Filed

vs. sector median

+18 wks slower

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Maine State AGbd_18acf747c4c38cc72022-12-13Verified
Massachusetts State AGbd_5eb0d8b524e6cf152022-12-13Verified
HHS OCRbd_7072dff5a7cc599e2022-12-13Verified

Name: Avem Health Partners
norm: avem health

Name: Avem Health Partners
norm: avem health
Industry: HealthcarellmTechnologyllm

Discovered: May 16, 2022
Breach occurred: May 14, 2022
Undetected for: 2 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 13, 2022
Affected individuals: 14state-resident count only
Data types: Identity (basic)Government IDHealth (basic)PHI
Data elements: Social Security numberDate of birthMedical information
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: External

During the incident: Offering a complimentary one-year membership to Experian’s IdentityWorks
Examining its vendor relationships and evaluating vendors’ security measures
Changes made: Examining its vendor relationships and evaluating vendors’ security measures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 30 weeks(211 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Maine State AGDec 13 · first

Massachusetts State AGDec 13 · first

HHS OCRDec 13 · first

Montana State AGDec 13 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-notification-letter-6.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 13, 2022
Raw hash: da6bc71d0dc6976b1553f5e81e853bf50a0fdd0c158c0d88e8ea362438df92b4

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityAvem Health Partners

Victim entityAvem Health Partners

Incidentdiscovered May 16, 2022

Stated responseOffering a complimentary one-year membership to Experian’s IdentityWorks

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov