DisclosureLens
HackingHealthcareHealthcareSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)Government IDFinancial accountHealth (basic)PHIMediumContained

CardioVascular Health Clinic

bd_45e946446233ef6b · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 4, 2025

Filed

Nov 26, 2025

To disclose

38 weeks

Affected

Not disclosed

Linked

4 filings

Confidence

64%
Full breach record for CardioVascular Health Clinic →2 incidents on file

CardioVascular Health Clinic experienced a data breach affecting its cloud services provider between Feb 18 and Mar 4, 2025. Unauthorized access compromised patient PII, PHI, SSNs, and financial data. The clinic engaged forensic investigators, notified law enforcement, and offered credit monitoring. No evidence of misuse was found. Notification sent Nov 26, 2025.

Vermont clock✗ VT AG >45 bday38 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 14 days
discovery → filing · 38 weeks / 267 days

Feb 18, 2025

Begins

Mar 4, 2025

Discovered

Nov 26, 2025

Filed

vs. sector median

+26 wks slower

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Filing propagation · 4 filings · 4 states

View merged incident ↗
Massachusetts State AGNov 26 · first
Nebraska State AGNov 26 · first
Vermont State AGNov 26 · first · this page
Illinois State AG+5d

Pattern: first filing Nov 26 (MA), last Dec 1 (IL) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.