HackingHealthcareProfessional ServicesHealthcareStolen CredentialsCustomer Data InvolvedIdentity (basic)PHILowContained

Schewitz Psychological Services Inc

bd_61c2911985257f3b · schema v1 · pii pii-v1

Severity

Low

Discovered

Mar 10, 2025

Filed

May 3, 2025

To disclose

8 weeks

Affected

Not disclosed

Linked

2 filings

Confidence

65%

Full breach record for Schewitz Psychological Services Inc →

Schewitz Psychological Services Inc (DBA: Couples Learn) reported that an unauthorized individual accessed their Acuity Scheduling account via a hacked staff password on or around March 10, 2025. The actor uploaded external email addresses and sent spam emails. Limited scheduling information (name, email, phone, appointment type) may have been accessed. No clinical records were involved. The incident has been contained.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 3 days

discovery → filing · 8 weeks / 54 days

Mar 7, 2025

Begins

Mar 10, 2025

Discovered

May 3, 2025

Filed

vs. sector median

3 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

HHS OCRbd_cf8451c1bc7e9af32025-05-03Verified

Name: Schewitz Psychological Services Inc
norm: schewitz psychological
Domain: coupleslearn.com

Name: Schewitz Psychological Services Inc
norm: schewitz psychological
Domain: coupleslearn.com
Also named: Schewitz Psychological Services Incdba oflegal entity
: Couples Learndba oftrade name
Industry: HealthcarellmProfessional Servicesllm

Discovered: Mar 10, 2025
Breach occurred: Mar 7, 2025
Undetected for: 3 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Identity (basic)PHI
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Third party: via Acuity Scheduling
Initial access: valid_credentials

During the incident: Conducted a full analysis of the incident in partnership with Acuity
Changed the compromised password
Verified that no wider breach of our systems occurred
Completed a review of our internal security policies and procedures
Re-trained our team on data security best practices
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(54 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

HHS OCRMay 3 · first

California State AGMay 3 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-602225
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 3, 2025
Raw hash: e860d80b2a7fbe6d9173298f9567aa6542f6f247040479180f1ec957498be62f

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entitySchewitz Psychological Services Inc

Victim entitySchewitz Psychological Services Inc

Incidentdiscovered Mar 10, 2025

Stated responseConducted a full analysis of the incident in partnership with Acuity

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov