HackingHealthcareHealthcareVulnerability ExploitZero-DaySupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)Government IDMediumResolved

AlohaCare

bd_5def3fef6b1cfeb3 · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 31, 2023

Filed

Nov 3, 2023

To disclose

22 weeks

Affected

Not disclosed

Linked

8 records

Confidence

65%

Full breach record for AlohaCare →

AlohaCare notified the California Attorney General of a data breach involving a zero-day vulnerability in the MOVEit file transfer tool. On May 31, 2023, the company learned it was part of the incident. The investigation concluded on October 17, 2023. Affected data may include names, addresses, dates of birth, and Social Security numbers. AlohaCare engaged cybersecurity experts and offered 12 months of free credit monitoring.

J jump to incidentP pin to compareR raw source

California clockDiscovered May 31, 2023 → Notified Nov 3, 2023156d ✗ CA 60-day late22 weeks discovery → filing

Incident timeline

discovery → filing · 22 weeks / 156 days

May 31, 2023

Discovered

Nov 3, 2023

Filed

vs. sector median

+13 wks slower

This filing is one of 8 records about the same incident.View merged incident

A leak claim by cl0p about this victim was first seen 100 days before this filing.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitecl0pbd_267bf6a743ba7a142023-07-26 · +100dVerified by operator

Regulatory filings (6) · sorted by filing gap

Maine State AGbd_1156614a6c22ef162023-11-03Candidate
Vermont State AGbd_35d7cd006030565a2023-11-03Verified
Hawaii State AGbd_51b508a9a3d16f902023-11-03Verified
Montana State AGbd_525c80eae29fa04d2023-11-03Verified

Show 2 more filings ↓

Massachusetts State AGbd_564fa52a9239acc82023-11-03Verified by operator
New Hampshire State AGbd_5933f9c2ef5b6eca2023-11-03Verified

Name: AlohaCare
norm: alohacare
Domain: alohacare.org

Name: AlohaCare
norm: alohacare
Domain: alohacare.org
Industry: Healthcarellm

Discovered: May 31, 2023
Materiality determined: —
Notification sent: Nov 3, 2023
Affected individuals: Not disclosed
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1195 Supply Chain Compromise
Threat actor: External
Third party: via Progress Software (MOVEit)
Initial access: supply_chain

During the incident: Hired a team of cybersecurity experts to investigate activity around the incident
Offered free credit monitoring and identity protection services
Changes made: Put additional security measures in place
Decreased the risk of a similar incident happening in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 22 weeks(156 days from discovery to filing)
Compliance flags: CA 60-day late · 156dLeak >90d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: May 31, 2023
→ Notified: Nov 3, 2023
156d 60 days (analyst band, pre-2026 discoveries) CA 60-day late

Statute	Window	Elapsed	Threshold	Status
California	Discovered: May 31, 2023 → Notified: Nov 3, 2023	156d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 7 states

View merged incident ↗

Maine State AGNov 3 · first

Vermont State AGNov 3 · first

Hawaii State AGNov 3 · first

Montana State AGNov 3 · first

Massachusetts State AGNov 3 · first

New Hampshire State AGNov 3 · first

California State AGNov 3 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-576076
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 3, 2023
Raw hash: 66675ab8701a84fa9ac5d550f894136377ddbeb7edcf117ef03ce32dd20f1660

Linked disclosures

Ransomware claims (1)

Regulatory filings (6) · sorted by filing gap

Reporting entityAlohaCare

Victim entityAlohaCare

Incidentdiscovered May 31, 2023

Stated responseHired a team of cybersecurity experts to investigate activity around the incident

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov