HackingIdentity (basic)Government IDMediumContained

DermCare Management

bd_678c13505db2136d · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 26, 2025

Filed

Apr 8, 2026

To disclose

—

Affected

25state residents only

Linked

6 filings

Confidence

66%

Full breach record for DermCare Management →2 incidents on file

DermCare Management notified Nebraska AG of a breach affecting 25 state residents. Unauthorized access to patient files occurred between Feb 14-26, 2025. Data exposed included names, SSNs, and driver's license numbers. DermCare engaged forensic specialists, notified law enforcement and HHS, and provided credit monitoring guidance to affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 12 days

Feb 14, 2025

Begins

Feb 26, 2025

Discovered

Apr 8, 2026

Filed

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Massachusetts State AGbd_7d8f067a12608bc52026-04-08Verified
California State AGbd_a2b77c6c4f99e21b2026-04-08Candidate
Washington State AGbd_c984d801ef1311ab2026-04-08Verified
Texas State AGbd_6404e5773595795d2026-04-10 · +2dVerified

Show 1 more filing ↓up to 7d gap

Illinois State AGbd_a9a03564a31eb2f92026-04-01 · +7dVerified

Name: DermCare Management
norm: dermcare management
Domain: dermcaremgt.com

Name: DermCare Management
norm: dermcare management
Domain: dermcaremgt.com

Discovered: Feb 26, 2025
Breach occurred: Feb 14, 2025 – Feb 26, 2025
Undetected for: 12 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 2, 2025
Affected individuals: 25state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1119 Automated Collection
Threat actor: External
Regulator citations: notified the Department of Health and Human Services

During the incident: Took steps to secure the network and investigate what occurred
Launched an investigation with the assistance of third-party forensic specialists
Undertook a comprehensive review of these files
Notified federal law enforcement regarding the event
Working to implement additional safeguards and training to its employees
Providing impacted individuals with guidance on how to better protect against identity theft and fraud
Providing individuals with information on how to place a fraud alert and security freeze on one’s credit file
Providing individuals with information on how to obtain a free credit report
Changes made: Implement additional safeguards and training to its employees
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Illinois State AGApr 1 · first

Massachusetts State AG+7d

California State AG+7d

Washington State AG+7d

Nebraska State AG+7d · this page

Texas State AG+9d

Pattern: first filing Apr 1 (IL), last Apr 10 (TX) — a 9-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://nebraska.gov/ago/data-breach/documents/ae865806-adf3-439c-9b3e-ac957ceb2341.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 8, 2026
Raw hash: f98884ad4d73359d848a58f90ebd8a2d48e325234808d32c801898849f533a4e

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityDermCare Management

Victim entityDermCare Management

Incidentdiscovered Feb 26, 2025

Stated responseTook steps to secure the network and investigate what occurred

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancenebraska.gov