HackingHealthcareHealthcareVulnerability ExploitSupply Chain (3P Vendor)Data ExfiltratedIdentity (basic)Government IDMediumContained

Caring Communities

bd_65ad819fa9d60385 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 6, 2023

Filed

Sep 27, 2023

To disclose

16 weeks

Affected

1state residents only

Linked

3 filings

Confidence

64%

Full breach record for Caring Communities →2 incidents on file

Caring Communities notified individuals of a third-party vendor breach involving MOVEit software compromise on June 6, 2023. The incident exposed names, addresses, and Social Security numbers. Caring Communities' own network was not impacted. Remediation included patching the vulnerability and adding security layers. Credit monitoring services were offered.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 16 weeks / 113 days

Jun 6, 2023

Begins

Jun 6, 2023

Discovered

Sep 27, 2023

Filed

vs. sector median

+4 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Maine State AGbd_a9d76dec656e7a5c2023-09-27Verified
Massachusetts State AGbd_be1d261bdd2137c12023-09-27Verified

Name: Caring Communities
norm: caring communities

Name: Caring Communities
norm: caring communities
Industry: Healthcarellm

Discovered: Jun 6, 2023
Breach occurred: Jun 6, 2023
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 26, 2023
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security numberDate of birth
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain CompromiseT1190 Exploit Public-Facing Application
Threat actor: ExternalFinancial
Initial access: supply_chain

During the incident: Continuing to work with the vendor involved in this incident to investigate this issue
Confirmed that our third-party vendor, along with MOVEit, patched the vulnerability
Reviewing existing policies and procedures regarding vendor services
Added additional layers of security between us and our third-party vendor
Providing access to Single Bureau Credit Monitoring/Single Bureau Credit Report/Single Bureau Credit Score services at no charge
Providing proactive fraud assistance through Cyberscout through Identity Force
Changes made: Patched the vulnerability in MOVEit software
Reviewing existing policies and procedures regarding vendor services
Added additional layers of security between us and our third-party vendor
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 16 weeks(113 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Maine State AGSep 27 · first

Massachusetts State AGSep 27 · first

Montana State AGSep 27 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-notification-letter-723.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 27, 2023
Raw hash: 90efd1524a003133eae874d51f02211d8bd05e5736844a85b7674e6fb28b4135

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityCaring Communities

Victim entityCaring Communities

Incidentdiscovered Jun 6, 2023

Stated responseContinuing to work with the vendor involved in this incident to investigate this issue

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov