HackingPIIIdentity (basic)Health (basic)MediumContained

Iowa Aftercare Services Network

bd_3f8a0a200cc65416 · schema v1 · pii pii-v2

Severity

Medium

Discovered

Mar 8, 2026

Filed

Oct 19, 2026

To disclose

32 weeks

Affected

5,985state residents only

Confidence

69%

Full breach record for Iowa Aftercare Services Network →

Iowa Department of Health and Human Services (Iowa HHS) reported a security breach affecting 5,985 Iowa residents. On or around March 8, 2026, a contractor managing the Iowa Aftercare Services Network (IASN) database identified a system vulnerability permitting unauthorized external access. The breach potentially exposed names and state medical identification numbers. Iowa HHS remediated the vulnerability, reset passwords, and engaged an independent consultant. Notifications were sent to affected individuals on October 14, 2026, offering credit monitoring services.

J jump to incidentP pin to compareR raw source

Iowa clock✓ IA AG ≤5 bday32 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 32 weeks / 225 days

Mar 8, 2026

Begins

Mar 8, 2026

Discovered

Oct 19, 2026

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed5,985 affectedView incident

Name: Iowa Department of Health and Human Services
norm: iowa department of health and human

Name: Iowa Aftercare Services Network
norm: iowa aftercare services network

Discovered: Mar 8, 2026
Breach occurred: Mar 8, 2026
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 14, 2026
Affected individuals: 5,985state-resident count only
Data types: PIIIdentity (basic)Health (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Regulator citations: Provided formal notice of a security incident to the Iowa Attorney General
Initial access: exploit_public_facing

During the incident: Vulnerability was remediated immediately
Systems were updated
User passwords were reset
Relevant policies and procedures were reviewed
Implemented enhanced security measures, including strengthened access controls and ongoing monitoring, with assistance from an independent breach consultant
Written notice to affected individuals was issued via first-class mail
Substitute notice was also provided on the IASN website
Enrolling in complimentary credit monitoring and identity protection services
Changes made: Strengthened access controls
Ongoing monitoring
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 32 weeks(225 days from discovery to filing)
Compliance flags: IA AG ≤5 bday
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.iowaattorneygeneral.gov/media/cms/10192026_Iowa_Department_of_Health__DE2FA0B820BCE.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 19, 2026
Raw hash: 5e29f08491feae34d1a0042cce78211d7acc9cc06b49cc3ae016464de5fa8b1d

Reporting entityIowa Department of Health and Human Services

Victim entityIowa Aftercare Services Network

Incidentdiscovered Mar 8, 2026

Stated responseVulnerability was remediated immediately

ComplianceIA AG ≤5 bday

Extraction provenanceno artifact recorded

Source provenancewww.iowaattorneygeneral.gov