HackingSupply Chain (3P Vendor)Customer Data InvolvedIDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTHEALTH_BASICPHIMediumContained
CardioVascular Health Clinic
bd_45e946446233ef6b · schema v1 · pii pii-v1
Full breach record for CardioVascular Health Clinic →CardioVascular Health Clinic experienced a data breach affecting its cloud services provider between Feb 18 and Mar 4, 2025. Unauthorized access compromised patient PII, PHI, SSNs, and financial data. The clinic engaged forensic investigators, notified law enforcement, and offered credit monitoring. No evidence of misuse was found. Notification sent Nov 26, 2025.
Vermont clock✗ VT AG >45 bday38 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident
Source provenance
- Source URL
- https://ago.vermont.gov/document/2025-11-26-cardiovascular-health-clinic-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Nov 26, 2025
- Raw hash
- 0e586f3ac55b4ce88f788b9a9f004fd60ec87545195e4a24d0a8160197d7bf8d
Reporting entity
- Name
- CardioVascular Health Clinicnorm: cardiovascular health clinic
Victim entity
- Name
- CardioVascular Health Clinicnorm: cardiovascular health clinic
Incident
- Discovered
- Mar 4, 2025
- Materiality determined
- —
- Notification sent
- Nov 26, 2025
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTHEALTH_BASICPHI
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1195 Supply Chain Compromise
- Threat actor
- External
- Initial access
- supply_chain
Compliance
- Time to disclose
- 38 weeks(267 days from discovery to filing)
- Compliance flags
- VT AG >45 bday
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.