HackingTechnologyHealthcareInformationVulnerability ExploitData ExfiltratedTargetedHealth (basic)Identity (basic)Government IDPHIMediumContained

Data Media Associates

bd_5fe69a1c32fcae1b · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 4, 2023

Filed

Sep 25, 2023

To disclose

16 weeks

Affected

657state residents only

Linked

14 filings

Confidence

69%

Full breach record for Data Media Associates →4 incidents on file

Data Media Associates, LLC notified Washington AG of unauthorized access to MOVEit Transfer data on June 4, 2023. Investigation confirmed data acquisition by June 30, 2023. 657 WA residents affected. Data included names, addresses, health insurance info, and potentially SSNs. DMA patched system, engaged experts, and offered credit monitoring.

J jump to incidentP pin to compareR raw source

Washington clock✗ WA AG >90d16 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

discovery → filing · 16 weeks / 113 days

Jun 4, 2023

Discovered

Sep 25, 2023

Filed

vs. sector median

3 wks faster

This filing is one of 14 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

Massachusetts State AGbd_738544e5a7db48382023-09-25Verified
Maine State AGbd_dd8d071e11b9229b2023-09-25Verified
HHS OCRbd_54c0ed94f96132692023-10-09 · +14dVerified by operator
Delaware State AGbd_8be62e38447897d82023-08-30 · +26dVerified

Show 6 more filings ↓up to 33d gap

New Hampshire State AGbd_450803226b4712aa2023-08-28 · +28dVerified
HHS OCRbd_30963eb787b1cdd82023-08-24 · +32dVerified by operator
Indiana State AGbd_260b7cb119fa0ee92023-08-23 · +33dCandidate
California State AGbd_44951a0ed5c0c1c72023-08-23 · +33dVerified
Montana State AGbd_721a9fed6d650d0b2023-08-23 · +33dVerified
Oregon State AGbd_9629ce6ff1f3e5c82023-08-23 · +33dVerified

Showing first 10 of 13 linked disclosures.

Name: Constangy, Brooks, Smith & Prophete, LLP
norm: constangy brooks smith prophete

Name: Data Media Associates
norm: data media associates
Industry: TechnologyllmHealthcarellm

Discovered: Jun 4, 2023
Materiality determined: —
Notification sent: Aug 23, 2023
Affected individuals: 657state-resident count only
Data types: Identity (basic)Government IDHealth (basic)
Data elements: NameSocial Security numberHealth insurance IDMedical information
WA-stated cause: Unauthorized Access
WA-stated duration: lifecycle Unknowndexposure Unknownd
WA-stated discovery: Found after the fact
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified Washington Attorney General Consumer Protection Division
Initial access: exploit_public_facing

During the incident: Took immediate steps to patch its MOVEit system in accordance with the developer’s instructions
Undertook a comprehensive investigation with the assistance of leading external experts
Established a toll-free call center through IDX to answer questions about the incident
Offered identity theft protection services through IDX
Changes made: Implemented all remediation measures recommended by the MOVEit software developer
Evaluating additional safeguards that can be put in place to further enhance the security of the data
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 16 weeks(113 days from discovery to filing)
Compliance flags: WA AG >90d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 10 states

View merged incident ↗

Indiana State AGAug 23 · first

California State AGAug 23 · first

Montana State AGAug 23 · first

Oregon State AGAug 23 · first

HHS OCR+1d

New Hampshire State AG+5d

Delaware State AG+7d

Massachusetts State AG+33d

Maine State AG+33d

Washington State AG+33d · this page

HHS OCR+47d

Pattern: first filing Aug 23 (IN), last Oct 9 (GA) — a 47-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Cascade drawn from the first 10 linked disclosures of 13 — the full spread may be wider.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM15677.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 25, 2023
Raw hash: 338f048425ea89c1c0eb37d457fb76211aedce39997cd2efe36b082445dba802

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entityConstangy, Brooks, Smith & Prophete, LLP

Victim entityData Media Associates

Incidentdiscovered Jun 4, 2023

Stated responseTook immediate steps to patch its MOVEit system in accordance with the developer’s instructions

ComplianceWA AG >90d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com