Social EngineeringHealthcareHealthcarePhishingStolen CredentialsCustomer Data InvolvedEmployee Data InvolvedPHIGovernment IDIdentity (basic)Health (basic)MediumContained

LUCENT HEALTH SOLUTIONS, LLC

bd_463ba52aeb32a826 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Oct 2, 2023

Filed

Jan 30, 2025

To disclose

16 months

Affected

21state residents only

Linked

8 filings

Confidence

66%

Full breach record for LUCENT HEALTH SOLUTIONS, LLC →

Lucent Health Solution, Inc. notified the Maryland Attorney General of a data security incident affecting 21 Maryland residents. On October 2, 2023, a manager opened a phishing email, leading to unauthorized access of an employee's email account for approximately 90 minutes. The attacker queried search terms but there is no evidence information was obtained or viewed. Affected data may include personal and health information, including Social Security numbers. Lucent Health engaged a cybersecurity firm, contained the incident, and is offering credit monitoring to those with SSNs impacted. Notices were sent to individuals on January 30, 2025.

J jump to incidentP pin to compareR raw source

Maryland clock✗ MD AG >90d16 months discovery → filing

Incident timeline

discovery → filing · 16 months / 486 days

Oct 2, 2023

Begins

Oct 2, 2023

Discovered

Jan 30, 2025

Filed

vs. sector median

+57 wks slower

This filing is one of 8 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (7) · sorted by filing gap

HHS OCRbd_7c3ab951c0a6e2392025-01-30Verified
Nebraska State AGbd_8c751aeaf5a6a5a52025-01-30Verified
California State AGbd_9a01bdfbcfed2b442025-01-30Verified
New Hampshire State AGbd_9eb1b05d5f2b77592025-01-30Verified

Show 3 more filings ↓up to 29d gap

Indiana State AGbd_f4a4ceeff5511ec02025-01-30Verified
Massachusetts State AGbd_d82847310e3758c62025-01-31 · +1dVerified
Illinois State AGbd_a9134ab09f210a822025-01-01 · +29dCandidate

Name: LUCENT HEALTH SOLUTIONS, LLC
norm: lucent health

Name: LUCENT HEALTH SOLUTIONS, LLC
norm: lucent health
Industry: Healthcarellm

Discovered: Oct 2, 2023
Breach occurred: Oct 2, 2023
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 30, 2025
Affected individuals: 21state-resident count only
Data types: PHIGovernment IDIdentity (basic)Health (basic)
Data elements: Social Security number
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: External
Regulator citations: Notified the Maryland Office of the Attorney General
Initial access: phishing_link

During the incident: Eliminated access to the employee’s email account within approximately ninety (90) minutes
Commenced an immediate and thorough investigation
Engaged a cybersecurity firm to assist with the investigation
Posted a website notice regarding the incident on June 28, 2024
Notified the covered entities of the incident on December 3, 2024
Provided covered entities with a list of potentially impacted individuals
Notified certain individuals about a data security incident on January 30, 2025
Changes made: Offering complimentary credit monitoring to the impacted residents who had their Social Security number impacted
Advising affected residents to remain vigilant in reviewing financial account statements
Advising affected residents about the process for placing a fraud alert and/or security freeze on their credit files
Providing affected residents with contact information for consumer reporting agencies and the Federal Trade Commission
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 16 months(486 days from discovery to filing)
Compliance flags: MD AG >90d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 8 states

View merged incident ↗

Illinois State AGJan 1 · first

HHS OCR+29d

Nebraska State AG+29d

California State AG+29d

New Hampshire State AG+29d

Indiana State AG+29d

Maryland State AG+29d · this page

Massachusetts State AG+30d

Pattern: first filing Jan 1 (IL), last Jan 31 (MA) — a 30-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.maryland.gov/resources-info/SBN%20Documents/2025/ITU-376275.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 30, 2025
Raw hash: d08460aa67effb3c12a0a8b4de1759dda5a497e49e949bdf85470565c1998893

Linked disclosures

Regulatory filings (7) · sorted by filing gap

Reporting entityLUCENT HEALTH SOLUTIONS, LLC

Victim entityLUCENT HEALTH SOLUTIONS, LLC

Incidentdiscovered Oct 2, 2023

Stated responseEliminated access to the employee’s email account within approximately ninety (90) minutes

ComplianceMD AG >90d

Extraction provenanceno artifact recorded

Source provenanceoag.maryland.gov