MONTANAHackingHealthcareHealthcarePHIHealth (basic)Identity (basic)HighContained

Ridgeway Pharmacy Ltd

bd_3997b95d40552321 · schema v1 · pii pii-v2

Severity

High

Discovered

—

Filed

Sep 21, 2026

To disclose

—

Affected

258,920

Linked

10 filings

Confidence

69%

Full breach record for Ridgeway Pharmacy Ltd →2 incidents on file

Ridgeway Pharmacy, Ltd reported to HHS on 2026-09-21 a Hacking/IT Incident affecting 258920 individuals. Breached information located on Network Server, Other. Business Associate was present.

J jump to incidentP pin to compareR raw source

HIPAA clock✓ HHS notified

⚠ no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.

⚠ No discovery dateThe OCR public portal omits the discovery date, so the 60-day notification clock cannot be evaluated from this source — only that the filing was submitted.

Incident timeline — partial

? — ?

Breach window unknown

Sep 21, 2026

Filed

No interval is drawn: no breach start or discovery date is on record for this filing.

This filing is one of 10 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (9) · sorted by filing gap

Oregon State AGbd_3cbb20bd9c12fee52026-09-21Verified
Indiana State AGbd_5a7183d2c946775b2026-09-21Verified
California State AGbd_5e64377c3be875a02026-09-21Verified
Delaware State AGbd_63b11c1c73fd18b72026-09-21Verified

Show 5 more filings ↓up to 8d gap

Vermont State AGbd_99ec0e1c45e12ef92026-09-21Verified
South Carolina State AGbd_ae2d9f4216576a302026-09-21Verified
Iowa State AGbd_e0ef03ad7fd2a89e2026-09-21Verified
Texas State AGbd_871b5e7d2b67ca972026-09-25 · +4dVerified
New Hampshire State AGbd_457ddcc981d04a1c2026-09-29 · +8dVerified

Name: Ridgeway Pharmacy Ltd
norm: ridgeway pharmacy
Industry: Health Care Services

Name: Ridgeway Pharmacy Ltd
norm: ridgeway pharmacy
Industry: Healthcaresource default

Discovered: Not extracted — the OCR public portal omits it
Materiality determined: —
Notification sent: —
Affected individuals: 258,920nationwide
Data types: PHIHealth (basic)Identity (basic)
HHS breach type: Hacking / IT incident
Where the data lived: Network serverOther
Covered-entity type: Healthcare providerBusiness associate involved
Attack vector: Unauthorized Access
MITRE ATT&CK: T1041 Exfiltration Over C2 Channel
Threat actor: External
Regulator citations: Notified HHS

Compliance flags: HHS notified
Discovery-date grounding: no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: not extracted
→ Notified: not extracted
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: not extracted → Notified: not extracted	—	regulatory submission	HHS notified

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 10 filings · 10 states

View merged incident ↗

Oregon State AGSep 21 · first

Indiana State AGSep 21 · first

California State AGSep 21 · first

Delaware State AGSep 21 · first

Vermont State AGSep 21 · first

South Carolina State AGSep 21 · first

Iowa State AGSep 21 · first

HHS OCRSep 21 · first · this page

Texas State AG+4d

New Hampshire State AG+8d

Pattern: first filing Sep 21 (OR), last Sep 29 (NH) — a 8-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Sep 21, 2026
Raw hash: 39146af24190862d2678d843163e8041a4314d26e06a4a4c41d3bb2235528bea

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html987 B

Download View at source

Linked disclosures

Regulatory filings (9) · sorted by filing gap

Reporting entityRidgeway Pharmacy Ltd

Victim entityRidgeway Pharmacy Ltd

IncidentUnauthorized Access

ComplianceHHS notified

Extraction provenanceno artifact recorded

Source provenanceocrportal.hhs.gov

Source filing