HackingSupply Chain (3P Vendor)Customer Data InvolvedBusiness Associate (HIPAA)Downstream VictimsPIIIDENTITY_BASICIDENTITY_GOVERNMENTHighContained
HEALTHEQUITY, INC.
bd_445b070801a0bce5 · schema v1 · pii pii-v1
Full breach record for HEALTHEQUITY, INC. →Supplemental notice filed by HealthEquity, Inc. (HIPAA Business Associate) with the New Hampshire Attorney General on April 9, 2025. This filing updates the July 26, 2024 breach notification, attributing impacted New Hampshire residents to specific Covered Entities. The breach involved unauthorized access to a third-party vendor's systems, affecting PII and government IDs of employees/beneficiaries across numerous organizations.
Leak gap clock✗ Leak >180d
⚠ no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.
This filing is one of 11 about the same incident.View merged incident
A leak claim by cl0p about this victim predates this filing by 664 days.View originating leak claim
Linked disclosures
Why this link?Regulatory filings (10) · sorted by filing gap
- bd_fcf0d383c0de759dNew Hampshire State AGfiled 2025-04-16(7d gap)Verified
- bd_1a13c9835dd1805bCalifornia State AGfiled 2025-04-17(8d gap)Candidate
- bd_77c8a9acc4269789New Hampshire State AGfiled 2025-04-17(8d gap)Verified
- bd_28461d0ca18db56cNew Hampshire State AGfiled 2025-05-09(30d gap)Verified
Show 6 more filings ↓Show fewer ↑up to 40d gap
- bd_9a2a12c83e6cb7aaNew Hampshire State AGfiled 2025-05-13(34d gap)Verified
- bd_21d2076c91f8736aNew Hampshire State AGfiled 2025-05-15(36d gap)Verified
- bd_494d121299552583California State AGfiled 2025-05-15(36d gap)Candidate
- bd_2266c3f182119ec4New Hampshire State AGfiled 2025-05-16(37d gap)Verified
- bd_6de5fe3402737e2cCalifornia State AGfiled 2025-05-16(37d gap)Candidate
- bd_7db48af763cdb930New Hampshire State AGfiled 2025-05-19(40d gap)Verified
Source provenance
- Source URL
- https://mm.nh.gov/files/uploads/doj/remote-docs/healthequity-20250409.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Apr 9, 2025
- Raw hash
- 5b8b5147603ef044773f821785766d487627431b2c03ac74b360c9736430241e
Reporting entity
- Name
- HEALTHEQUITY, INC.norm: healthequity
- Domain
- healthequity.com
Victim entity
- Name
- HEALTHEQUITY, INC.norm: healthequity
- Domain
- healthequity.com
Incident
- Discovered
- —
- Materiality determined
- —
- Notification sent
- —
- Affected individuals
- 2,586
- Data types
- PIIIDENTITY_BASICIDENTITY_GOVERNMENT
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1195 Supply Chain Compromise
- Threat actor
- Partner
- Regulator citations
- Filed supplemental notice with New Hampshire Office of the Attorney General
- Initial access
- supply_chain
Compliance
- Compliance flags
- Leak >180d
- Discovery-date grounding
- no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.