GEORGIAMalwareHealthcareHealthcareRansomwareBusiness Associate (HIPAA)Customer Data InvolvedData EncryptedRansom DemandedIdentity (basic)Health (basic)Financial accountPHIHigh

Young Consulting

bd_5ce39f38f478348c · schema v1 · pii pii-v1

Severity

High

Discovered

—

Filed

Sep 11, 2024

To disclose

—

Affected

961,003

Linked

23 records

Confidence

50%

Full breach record for Young Consulting →

The business associate (BA), Young Consulting LLC, reported that it experienced a ransomware attack that affected the protected health information (PHI) of 961,003 individuals. The PHI involved included names, dates of birth, health insurance information, diagnoses, and other treatment information. The BA notified HHS, affected individuals, the media, law enforcement, and published substitute notice on its website. In response to the breach, the BA reviewed and strengthened its policies and procedures, implemented a variety of additional security software protections, hired additional security staff, and required additional training.

J jump to incidentP pin to compareR raw source

Leak gap clock⏱ Leak >90d

⚠ no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.

⚠ No discovery dateThe OCR public portal omits the discovery date, so the 60-day notification clock cannot be evaluated from this source — only that the filing was submitted.

Incident timeline — partial

? — ?

Breach window unknown

Sep 11, 2024

Filed

No interval is drawn: no breach start or discovery date is on record for this filing.

This filing is one of 23 records about the same incident.View merged incident

A leak claim by blacksuit about this victim was first seen 127 days before this filing.View originating leak claim

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

Indiana State AGbd_4ded0f97196230202025-01-25 · +136dVerified by operator
Maryland State AGbd_400059bc40f88d5e2025-01-29 · +140dVerified by operator
California State AGbd_7b04f3239ae6547d2025-01-29 · +140dVerified by operator
New Hampshire State AGbd_1f6566b2d540498f2025-04-11 · +212dVerified by operator

Show 6 more filings ↓up to 295d gap

California State AGbd_74ee160876e9cb592025-04-11 · +212dVerified by operator
Maine State AGbd_a6f94afdabec56732025-04-11 · +212dVerified
Maine State AGbd_bedd380143f5919b2025-07-02 · +294dVerified by operator
New Hampshire State AGbd_d8afddd50e05d3152025-07-02 · +294dVerified by operator
California State AGbd_f7562288ebd80f402025-07-02 · +294dVerified by operator
Texas State AGbd_25f6da738738d1e02025-07-03 · +295dVerified by operator

Showing first 10 of 22 linked disclosures.

Name: Young Consulting
norm: young consulting
Domain: youngconsulting-us.com
Industry: Business Associate

Name: Young Consulting
norm: young consulting
Domain: youngconsulting-us.com
Industry: Business Associate
Industry: Healthcaresource default

Discovered: Not extracted — the OCR public portal omits it
Materiality determined: —
Notification sent: —
Affected individuals: 961,003nationwide
Data types: Identity (basic)Health (basic)Financial accountPHI
HHS breach type: Hacking / IT incident
Where the data lived: Network server
Covered-entity type: Business associate
Attack vector: Unauthorized Access
Threat actor: External
Regulator citations: Notified HHSNotified law enforcement

Changes made: Strengthened its policies and procedures
Implemented a variety of additional security software protections
Hired additional security staff
Required additional training
Source: Quoted from the filing itself, not independently verified.

Compliance flags: Leak >90dHHS notified
Discovery-date grounding: no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: not extracted
→ Notified: not extracted
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: not extracted → Notified: not extracted	—	regulatory submission	HHS notified

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 7 states

View merged incident ↗

HHS OCRSep 11 · first · this page

Indiana State AG+136d

Maryland State AG+140d

California State AG+140d

New Hampshire State AG+212d

California State AG+212d

Maine State AG+212d

Maine State AG+294d

New Hampshire State AG+294d

California State AG+294d

Texas State AG+295d

Pattern: first filing Sep 11 (GA), last Jul 3 (TX) — a 295-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Cascade drawn from the first 10 linked disclosures of 22 — the full spread may be wider.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Sep 11, 2024
Raw hash: e127762844a1277f548b7c69edc4518710f1ae67391d16c74ed89b1340b103aa

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html1.6 KB

Download View at source

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entityYoung Consulting

Victim entityYoung Consulting

IncidentUnauthorized Access

Stated responseStrengthened its policies and procedures

ComplianceLeak >90d

Extraction provenanceno artifact recorded

Source provenanceocrportal.hhs.gov

Source filing