MalwareHealthcareTechnologyHealthcareRansomwareVulnerability ExploitCLOP GroupData ExfiltratedData EncryptedCustomer Data InvolvedSupply Chain (3P Vendor)TargetedIdentity (basic)Government IDHealth (basic)PHIHighContained

PH TECH, LLC

bd_48e51f819b175d34 · schema v1 · pii pii-v1

Severity

High

Discovered

Jun 2, 2023

Filed

Jul 10, 2023

To disclose

5 weeks

Affected

3,288state residents only

Linked

8 filings

Confidence

70%

Full breach record for PH TECH, LLC →

PH TECH, a healthcare technology firm, disclosed a ransomware incident involving the MOVEit transfer platform. The CLOP Group exploited a vulnerability on May 30, 2023, exfiltrating PHI and PII (SSN, DOB, names) of 3,288 Washington residents. PH TECH discovered the attack on June 2, 2023, engaged forensic investigators, notified law enforcement, and began notifying affected individuals in mid-July 2023.

J jump to incidentP pin to compareR raw source

Washington clock⏱ WA AG >30d5 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 3 days

discovery → filing · 5 weeks / 38 days

May 30, 2023

Begins

Jun 2, 2023

Discovered

Jul 10, 2023

Filed

vs. sector median

7 wks faster

This filing is one of 8 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (7) · sorted by filing gap

Oregon State AGbd_d22af6d5b363426e2023-07-24 · +14dVerified
Oregon State AGbd_fee806c9a4452c7c2023-07-31 · +21dVerified
Montana State AGbd_72b7c1efb706073b2023-08-02 · +23dVerified
Massachusetts State AGbd_85fd887def1bde882023-08-02 · +23dVerified

Show 3 more filings ↓up to 37d gap

Maine State AGbd_40a9ef82c057f2ee2023-08-11 · +32dVerified
New Hampshire State AGbd_ee4a6fc951333f4a2023-08-11 · +32dVerified
California State AGbd_c955bd885464f2722023-08-16 · +37dVerified

Name: PH TECH, LLC
norm: ph tech

Name: PH TECH, LLC
norm: ph tech
Industry: HealthcarellmTechnologyllm

Discovered: Jun 2, 2023
Breach occurred: May 30, 2023
Undetected for: 3 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 17, 2023
Affected individuals: 3,288state-resident count only
Data types: Identity (basic)Government IDHealth (basic)PHI
Data elements: NameSocial Security numberDate of birthHealth insurance IDMedical information
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 1-99dexposure 0d
WA-stated discovery: Found after the fact
Attack vector: Third-Party / Supply Chain· CLOP Group
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 ChannelT1486 Data Encrypted for Impact
Threat actor: CLOP GroupExternalFinancial
Regulator citations: Notified the Federal Bureau of Investigation (FBI)Notified the Oregon State Police (OSP)
Initial access: exploit_public_facing

During the incident: Disabled platform access from our network
Patched the vulnerability
Rebuilt internal access to the platform
Engaged a forensic cybersecurity firm to assist in the investigation
Notified the Federal Bureau of Investigation (FBI)
Notified the Oregon State Police (OSP)
Took affected systems offline
Worked with Progress MOVEit to patch vulnerabilities
Conducted a thorough forensic analysis
Changes made: Offering free identity theft protection with a company called IDX
12 Months/24 months of credit and CyberScan monitoring
ID theft recovery services
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(38 days from discovery to filing)
Compliance flags: WA AG >30d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 7 states

View merged incident ↗

Washington State AGJul 10 · first · this page

Oregon State AG+14d

Oregon State AG+21d

Montana State AG+23d

Massachusetts State AG+23d

Maine State AG+32d

New Hampshire State AG+32d

California State AG+37d

Pattern: first filing Jul 10 (WA), last Aug 16 (CA) — a 37-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA25746.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 10, 2023
Raw hash: ccdefd1585701cb6a1a96afb5abdb78e31304a9f7d5f849fc77b4cc29c9ebb88

Linked disclosures

Regulatory filings (7) · sorted by filing gap

Reporting entityPH TECH, LLC

Victim entityPH TECH, LLC

Incidentdiscovered Jun 2, 2023

Stated responseDisabled platform access from our network

ComplianceWA AG >30d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com