HackingHealthcareFinancial ServicesHealthcareVulnerability ExploitZero-DayData ExfiltratedCustomer Data InvolvedPIIPHIIdentity (basic)Government IDMediumContained

AlohaCare

bd_5933f9c2ef5b6eca · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 31, 2023

Filed

Nov 3, 2023

To disclose

22 weeks

Affected

12state residents only

Linked

8 records

Confidence

67%

Full breach record for AlohaCare →

AlohaCare, a Hawaii-based health insurance provider, notified the New Hampshire Attorney General on November 3, 2023, of a data security incident involving the MOVEit file transfer tool vulnerability. The incident, discovered on or around May 31, 2023, impacted 12 New Hampshire residents. The breach exposed personal and protected health information. AlohaCare engaged third-party experts, notified credit bureaus, and offered complimentary credit monitoring and identity theft recovery services to affected individuals.

J jump to incidentP pin to compareR raw source

Leak gap clock⏱ Leak >90d22 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

discovery → filing · 22 weeks / 156 days

May 31, 2023

Discovered

Nov 3, 2023

Filed

vs. sector median

+13 wks slower

This filing is one of 8 records about the same incident.View merged incident

A leak claim by cl0p about this victim was first seen 100 days before this filing.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitecl0pbd_267bf6a743ba7a142023-07-26 · +100dVerified by operator

Regulatory filings (6) · sorted by filing gap

Maine State AGbd_1156614a6c22ef162023-11-03Candidate
Vermont State AGbd_35d7cd006030565a2023-11-03Verified
Hawaii State AGbd_51b508a9a3d16f902023-11-03Verified
Montana State AGbd_525c80eae29fa04d2023-11-03Verified

Show 2 more filings ↓

Massachusetts State AGbd_564fa52a9239acc82023-11-03Verified by operator
California State AGbd_5def3fef6b1cfeb32023-11-03Verified

Name: Lewis Brisbois Bisgaard & Smith, PLLC
norm: lewis brisbois bisgaard smith

Name: AlohaCare
norm: alohacare
Domain: alohacare.org
Industry: HealthcarellmFinancial Servicesllm

Discovered: May 31, 2023
Materiality determined: —
Notification sent: Nov 3, 2023
Affected individuals: 12state-resident count only
Data types: PIIPHIIdentity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1486 Data Encrypted for Impact
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney General's Office
Initial access: exploit_public_facing

During the incident: Engaged a team of third-party digital and cybersecurity experts to assist with investigating the extent of any unauthorized activity
Initiated a comprehensive review of the affected files
Notified the major credit reporting agencies, TransUnion, Equifax, and Experian
Offered all individuals whose information was involved complimentary services through TransUnion
Changes made: Implemented additional security features in an effort to prevent a similar incident from occurring in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 22 weeks(156 days from discovery to filing)
Compliance flags: Leak >90d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 7 states

View merged incident ↗

Maine State AGNov 3 · first

Vermont State AGNov 3 · first

Hawaii State AGNov 3 · first

Montana State AGNov 3 · first

Massachusetts State AGNov 3 · first

California State AGNov 3 · first

New Hampshire State AGNov 3 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/alohacare-20231103.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 3, 2023
Raw hash: 609963873623775c8a6dc5ab6eeb4d3cf74e9c9f92103a480edc68ebf6befd63

Linked disclosures

Ransomware claims (1)

Regulatory filings (6) · sorted by filing gap

Reporting entityLewis Brisbois Bisgaard & Smith, PLLC

Victim entityAlohaCare

Incidentdiscovered May 31, 2023

Stated responseEngaged a team of third-party digital and cybersecurity experts to assist with investigating the extent of any unauthorized activity

ComplianceLeak >90d

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov