AccidentalHealthcareProfessional ServicesHealthcareMisconfigurationData ExfiltratedCustomer Data InvolvedPHIGovernment IDIdentity (basic)Health (basic)MediumContained

Altos Inc

bd_3f372da7fd54a53e · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 17, 2025

Filed

Aug 1, 2025

To disclose

6 weeks

Affected

Not disclosed

Linked

11 filings

Confidence

66%

Full breach record for Altos Inc →

Altos, a billing services provider for healthcare providers in southern California, experienced a data breach due to an internal system exposed to the Internet. The incident occurred between May 30 and May 31, 2025, and was discovered on June 17, 2025. An unauthorized third party accessed the system and may have exfiltrated personal and health information, including names, addresses, dates of birth, Social Security numbers, and health information. Altos blocked access to the system, hired a cybersecurity firm, and is offering credit monitoring to affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 18 days

discovery → filing · 6 weeks / 45 days

May 30, 2025

Begins

Jun 17, 2025

Discovered

Aug 1, 2025

Filed

vs. sector median

5 wks faster

This filing is one of 11 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

Nebraska State AGbd_7be4fd51f86b0a592025-08-01Candidate
Massachusetts State AGbd_a55ffccefbb94ba22025-08-01Verified
Indiana State AGbd_de689aaa60106ceb2025-08-01Verified
HHS OCRbd_062a49a15a817d372025-08-11 · +10dVerified

Show 6 more filings ↓up to 10d gap

HHS OCRbd_2670ce19da20fec72025-08-11 · +10dVerified
HHS OCRbd_56b1f270267296a02025-08-11 · +10dVerified
HHS OCRbd_60b51f79707513f42025-08-11 · +10dVerified
HHS OCRbd_8b89cd7c304c5b3b2025-08-11 · +10dVerified
HHS OCRbd_92a4b394745af1bd2025-08-11 · +10dVerified
HHS OCRbd_9c643f1b8e4d3dd22025-08-11 · +10dVerified

Name: Altos Inc
norm: altos

Name: Altos Inc
norm: altos
Industry: HealthcarellmProfessional Servicesllm

Discovered: Jun 17, 2025
Breach occurred: May 30, 2025 – May 31, 2025
Undetected for: 18 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: PHIGovernment IDIdentity (basic)Health (basic)
Data elements: Social Security numberDate of birth
Attack vector: Misconfiguration
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Initial access: exploit_public_facing

During the incident: Immediately blocked access to the exposed system
Hired a cybersecurity firm to conduct the investigation
Secured the system that was exposed to the Internet
Undergone additional security reviews
Providing credit monitoring services
Changes made: Taking steps to improve overall security posture
Strengthening security processes and technology
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(45 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 4 states

View merged incident ↗

Nebraska State AGAug 1 · first

Massachusetts State AGAug 1 · first

Indiana State AGAug 1 · first

California State AGAug 1 · first · this page

HHS OCR+10d

Pattern: first filing Aug 1 (NE), last Aug 11 (CA) — a 10-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-606489
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 1, 2025
Raw hash: 0fa25ab194bfb202402690357ef921091fdc658813da84ca686fac098ad34810

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entityAltos Inc

Victim entityAltos Inc

Incidentdiscovered Jun 17, 2025

Stated responseImmediately blocked access to the exposed system

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov