DisclosureLens
HackingHealthcareFinancial ServicesHealthcareSupply Chain (3P Vendor)Customer Data InvolvedBusiness Associate (HIPAA)Downstream VictimsPIIIdentity (basic)Government IDHighContained

HEALTHEQUITY, INC.

bd_445b070801a0bce5 · schema v1 · pii pii-v1

Severity

High

Discovered

—

Filed

Apr 9, 2025

To disclose

—

Affected

2,586state residents only

Linked

29 filings

Confidence

67%
Full breach record for HEALTHEQUITY, INC. →9 incidents on file

Supplemental notice filed by HealthEquity, Inc. (HIPAA Business Associate) with the New Hampshire Attorney General on April 9, 2025. This filing updates the July 26, 2024 breach notification, attributing impacted New Hampshire residents to specific Covered Entities. The breach involved unauthorized access to a third-party vendor's systems, affecting PII and government IDs of employees/beneficiaries across numerous organizations.

Leak gap clock✗ Leak >180d
⚠ no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.

Incident timeline — partial

? — ?

Breach window unknown

Apr 9, 2025

Filed

—

Corroborated · see linked filings

Compliance clocks stay unassessable until a regulatory filing lands. Dashed segments fill in automatically when corroboration arrives.

This filing is one of 29 about the same incident.View merged incident
A leak claim by cl0p about this victim predates this filing by 664 days.View originating leak claim

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

Show 6 more filings ↓up to 44d gap

Showing first 10 of 28 linked disclosures.

Filing propagation · 11 filings · 3 states

View merged incident ↗
New Hampshire State AGApr 9 · first · this page
New Hampshire State AG+30d
California State AG+34d
New Hampshire State AG+34d
New Hampshire State AG+36d
California State AG+36d
New Hampshire State AG+37d
California State AG+37d
Massachusetts State AG+40d
New Hampshire State AG+40d
Massachusetts State AG+44d

Pattern: first filing Apr 9 (NH), last May 23 (MA) — a 44-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Cascade drawn from the first 10 linked disclosures of 28 — the full spread may be wider.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.