HackingIdentity (basic)LowContained

Family Health Services, Inc

bd_6942416840a066ae · schema v1 · pii pii-v2

Severity

Low

Discovered

Feb 1, 2025

Filed

May 23, 2025

To disclose

—

Affected

Not disclosed

Linked

4 filings

Confidence

65%

Full breach record for Family Health Services, Inc →

Family Health Services, Inc. (FHSI) notified Nebraska residents of a data incident in January 2025. Unauthorized actors accessed FHSI systems from Jan 27 to Feb 1, 2025, downloading personal information (name, address). FHSI discovered the breach on Feb 1, 2025, changed passwords, notified law enforcement, and engaged cybersecurity professionals. No identity theft was known at the time of notification.

J jump to incidentP pin to compareR raw source

Leak gap clock⏱ Leak >30d

Incident timeline

undetected · 5 days

Jan 27, 2025

Begins

Feb 1, 2025

Discovered

May 23, 2025

Filed

This filing is one of 4 about the same incident.View merged incident

A leak claim by medusa about this victim predates this filing by 59 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitemedusabd_3271a71194b001732025-03-24 · +59dVerified

Regulatory filings (2) · sorted by filing gap

HHS OCRbd_5c4f3a937b5d7f8f2025-05-23Verified
Indiana State AGbd_af6c8a7d2e4152f72025-05-23Verified

Name: Family Health Services, Inc
norm: family health
Domain: fhsi.org

Name: Family Health Services, Inc
norm: family health
Domain: fhsi.org

Discovered: Feb 1, 2025
Breach occurred: Jan 27, 2025 – Feb 1, 2025
Undetected for: 5 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 23, 2025
Affected individuals: Not disclosed
Data types: Identity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: reported this Incident to relevant government agencies
Initial access: exploit_public_facing

During the incident: Changed passwords
Notifying federal law enforcement
Engaging cybersecurity and privacy professionals to assist
Enhancing endpoint detection and monitoring capabilities
Changes made: Add further technical safeguards to its existing protections
Source: Quoted from the filing itself, not independently verified.

Compliance flags: Leak >30d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 2 states

View merged incident ↗

HHS OCRMay 23 · first

Indiana State AGMay 23 · first

Nebraska State AGMay 23 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://nebraska.gov/ago/data-breach/documents/72b00579-6ab9-4451-986c-dbf93a5a6a62.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 23, 2025
Raw hash: 10528b874deb68822df5ecf1adf218f355825a505b2ff99be9f2e98da2217c33

Linked disclosures

Ransomware claims (1)

Regulatory filings (2) · sorted by filing gap

Reporting entityFamily Health Services, Inc

Victim entityFamily Health Services, Inc

Incidentdiscovered Feb 1, 2025

Stated responseChanged passwords

ComplianceLeak >30d

Extraction provenanceno artifact recorded

Source provenancenebraska.gov