HackingHealthcareProfessional ServicesHealthcareSupply Chain (3P Vendor)Customer Data InvolvedPIIPHIIdentity (basic)LowContained

NationsBenefits Holdings, LLC

bd_5cf8474b7cde8f07 · schema v1 · pii pii-v1

Severity

Low

Discovered

Feb 7, 2023

Filed

Apr 14, 2023

To disclose

9 weeks

Affected

Not disclosed

Linked

11 filings

Confidence

64%

Full breach record for NationsBenefits Holdings, LLC →2 incidents on file

NationsBenefits Holdings, LLC notified California residents that a third-party vendor, Fortra, LLC, experienced a cybersecurity incident on or around January 30, 2023. NationsBenefits learned of the incident on February 7, 2023. The attack involved unauthorized access to data exchanged via Fortra's software. NationsBenefits stopped using the software, engaged forensic investigators, and notified law enforcement. Affected individuals were offered 24 months of identity monitoring.

J jump to incidentP pin to compareR raw source

California clockDiscovered Feb 7, 2023 → Notified Apr 13, 202365d ✗ CA 60-day late9 weeks discovery → filing

Incident timeline

undetected · 8 days

discovery → filing · 9 weeks / 66 days

Jan 30, 2023

Begins

Feb 7, 2023

Discovered

Apr 14, 2023

Filed

vs. sector median

3 wks faster

This filing is one of 11 about the same incident.View merged incident

Part of FORTRA, LLC supply-chain incident (2023) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

Vermont State AGbd_1b538b7a6b069a1e2023-04-13 · +1dVerified
Montana State AGbd_27eb698b3f802e522023-04-13 · +1dVerified
Indiana State AGbd_2991e4635882bafd2023-04-13 · +1dVerified
New Hampshire State AGbd_7a3042e338cc12002023-04-13 · +1dVerified

Show 6 more filings ↓up to 21d gap

Delaware State AGbd_e00425fe19d51b102023-04-13 · +1dVerified
HHS OCRbd_e85b721b457f6efc2023-04-13 · +1dVerified
South Carolina State AGbd_f4ea46e421b654be2023-04-13 · +1dVerified
Massachusetts State AGbd_538bde34078d74742023-04-20 · +6dVerified
Oregon State AGbd_90ff9cd7813fad7c2023-05-01 · +17dVerified
Maine State AGbd_be7b07047f2e066a2023-05-05 · +21dVerified

Name: NationsBenefits Holdings, LLC
norm: nationsbenefits holdings

Name: NationsBenefits Holdings, LLC
norm: nationsbenefits holdings
Industry: HealthcarellmProfessional Servicesllm

Discovered: Feb 7, 2023
Breach occurred: Jan 30, 2023
Undetected for: 8 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 13, 2023
Affected individuals: Not disclosed
Data types: PIIPHIIdentity (basic)
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain Compromise
Threat actor: External
Third party: via Fortra, LLC
Initial access: supply_chain

During the incident: Immediately took steps to secure our systems
Launched an investigation conducted by an experienced outside law firm and a leading cybersecurity firm
Analyzed the impacted data to determine whether any individual’s personal information was subject to unauthorized access or acquisition
Immediately stopped using Fortra’s software
Notified law enforcement authorities
Offering a complimentary 24-month membership to Experian’s IdentityWorks
Changes made: Implemented and are continuing to implement additional procedures to further strengthen the security of our IT system environments
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(66 days from discovery to filing)
Compliance flags: CA 60-day late · 65d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Feb 7, 2023
→ Notified: Apr 13, 2023
65d 60 days (analyst band, pre-2026 discoveries) CA 60-day late

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Feb 7, 2023 → Notified: Apr 13, 2023	65d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 11 states

View merged incident ↗

Vermont State AGApr 13 · first

Montana State AGApr 13 · first

Indiana State AGApr 13 · first

New Hampshire State AGApr 13 · first

Delaware State AGApr 13 · first

HHS OCRApr 13 · first

South Carolina State AGApr 13 · first

California State AG+1d · this page

Massachusetts State AG+7d

Oregon State AG+18d

Maine State AG+22d

Pattern: first filing Apr 13 (VT), last May 5 (ME) — a 22-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-565565
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 14, 2023
Raw hash: 814310cbe5a77c97d402d1a3ac2339499c35551fbd288bd1875a66123d429ee0

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entityNationsBenefits Holdings, LLC

Victim entityNationsBenefits Holdings, LLC

Incidentdiscovered Feb 7, 2023

Stated responseImmediately took steps to secure our systems

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov