HackingHealthcareTechnologyHealthcareVulnerability ExploitZero-DaySupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedIdentity (basic)Health (basic)LowContained

Welltok

bd_5e4b7107bd1176de · schema v1 · pii pii-v1

Severity

Low

Discovered

Jul 26, 2023

Filed

Dec 22, 2023

To disclose

21 weeks

Affected

Not disclosed

Linked

22 filings

Confidence

65%

Full breach record for Welltok →3 incidents on file

Welltok, Inc. disclosed that an unknown actor exploited a zero-day vulnerability in Progress Software's MOVEit Transfer tool between May 30-31, 2023, exfiltrating data including names, addresses, phone numbers, Member IDs, DOB/Age, Medicaid IDs, and plan types. Welltok learned of the potential impact on July 26, 2023, and confirmed the breach on August 11, 2023. The company engaged third-party cybersecurity specialists and is offering 24 months of credit monitoring via Experian.

J jump to incidentP pin to compareR raw source

California clockDiscovered Jul 26, 2023 → Notified Dec 22, 2023149d ✗ CA 60-day late21 weeks discovery → filing

Incident timeline

undetected · 57 days

discovery → filing · 21 weeks / 149 days

May 30, 2023

Begins

Jul 26, 2023

Discovered

Dec 22, 2023

Filed

vs. sector median

+12 wks slower

This filing is one of 22 filings about the same incident.View merged incident

Part of Progress Software Corporation supply-chain incident (2023) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

Maine State AGbd_0328ea1fdab9c4592023-12-22Verified by operator
Vermont State AGbd_8ca9e17ac4dfbe9b2023-12-22Verified
New Hampshire State AGbd_db6e6d3e58b51e902023-12-22Verified
Maine State AGbd_063b1deb8c7a2bff2023-12-15 · +7dVerified by operator

Show 6 more filings ↓up to 154d gap

Vermont State AGbd_69d99adc86ef4dcf2023-12-15 · +7dVerified
California State AGbd_b765e398c9850ca12023-12-15 · +7dVerified
New Hampshire State AGbd_e5a605be617ae3962023-12-15 · +7dVerified
California State AGbd_cf54a7692c42c7aa2024-01-08 · +17dVerified by operator
California State AGbd_d2c5cdddd25b96d92024-02-28 · +68dVerified by operator
South Carolina State AGbd_57aa66e4578bd8912024-05-24 · +154dVerified by operator

Showing first 10 of 21 linked disclosures.

Name: Welltok
norm: welltok
Domain: welltok.com

Name: Welltok
norm: welltok
Domain: welltok.com
Industry: HealthcarellmTechnologyllm

Discovered: Jul 26, 2023
Breach occurred: May 30, 2023 – May 31, 2023
Undetected for: 57 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 22, 2023
Affected individuals: Not disclosed
Data types: Identity (basic)Health (basic)
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1195 Supply Chain CompromiseT1041 Exfiltration Over C2 Channel
Threat actor: External
Initial access: supply_chain

During the incident: Initiated an investigation with the assistance of third-party cybersecurity specialists
Reviewed and enhanced existing policies and procedures related to data privacy
Providing access to 24-months of free credit monitoring and identity protection services provided by Experian
Changes made: Reviewing and enhancing existing policies and procedures related to data privacy to reduce the likelihood of a similar future event
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 21 weeks(149 days from discovery to filing)
Compliance flags: CA 60-day late · 149d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Jul 26, 2023
→ Notified: Dec 22, 2023
149d 60 days (analyst band, pre-2026 discoveries) CA 60-day late

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Jul 26, 2023 → Notified: Dec 22, 2023	149d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 5 states

View merged incident ↗

Maine State AGDec 15 · first

Vermont State AGDec 15 · first

California State AGDec 15 · first

New Hampshire State AGDec 15 · first

Maine State AG+7d

Vermont State AG+7d

New Hampshire State AG+7d

California State AG+7d · this page

California State AG+24d

California State AG+75d

South Carolina State AG+161d

Pattern: first filing Dec 15 (ME), last May 24 (SC) — a 161-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Cascade drawn from the first 10 linked disclosures of 21 — the full spread may be wider.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-578388
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 22, 2023
Raw hash: 1a57b5e7543d685e1301fff1af60696d7dd78380c64657330df0187bf83d3f4c

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entityWelltok

Victim entityWelltok

Incidentdiscovered Jul 26, 2023

Stated responseInitiated an investigation with the assistance of third-party cybersecurity specialists

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov