HEALTHEQUITY, INC.
bd_6b441c84e03e4bf6 · schema v1 · pii pii-v1
Full breach record for HEALTHEQUITY, INC. →9 incidents on fileThreat-actor claim — not a regulatory filing
This row is a claim by the ransomware group Cl0p on its public extortion blog. It has not been validated by the victim or any regulator. Treat attribution and counts as the threat actor's assertion until a regulatory filing or victim disclosure corroborates them.
Source: Ransomware.live
Post text · scraped from the leak site
HealthEquity - Industry's #1 HSA Administrator
J jump to incidentP pin to compareR raw source
Incident timeline — mostly unverified
? — ?
Breach window unknown
Jun 15, 2023
Claim posted
—
Corroborated · see linked filings
Compliance clocks stay unassessable until a regulatory filing lands. Dashed segments fill in automatically when corroboration arrives.
Claim → filing
—
Compliance clock
Not assessable
Linked disclosures
Why this link?Regulatory filings (10) · sorted by filing gap
- New Hampshire State AGbd_28461d0ca18db56c2025-05-09 · +694dVerified
- California State AGbd_7e9b16c89d34dab02025-05-13 · +698dVerified
- New Hampshire State AGbd_9a2a12c83e6cb7aa2025-05-13 · +698dVerified
- New Hampshire State AGbd_21d2076c91f8736a2025-05-15 · +700dVerified
Show 6 more filings ↓Show fewer ↑up to 708d gap
- California State AGbd_494d1212995525832025-05-15 · +700dVerified
- New Hampshire State AGbd_2266c3f182119ec42025-05-16 · +701dVerified
- California State AGbd_6de5fe3402737e2c2025-05-16 · +701dVerified
- Massachusetts State AGbd_6379ee1c193eb9472025-05-19 · +704dVerified
- New Hampshire State AGbd_7db48af763cdb9302025-05-19 · +704dVerified
- Massachusetts State AGbd_ae96121ac373c5d22025-05-23 · +708dVerified
Showing first 10 of 28 linked disclosures.
Filing propagation · 11 filings · 3 states
View merged incident ↗Pattern: first filing Jun 15, last May 23 (MA) — a 708-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?
Cascade drawn from the first 10 linked disclosures of 28 — the full spread may be wider.
Evidence ladder
Attacker assertion only. Establishes: claim date, group, alleged victim.
Unlocks: incident narrative, operational impact. Still no compliance clock.
Unlocks: discovery date, data types, affected count, compliance clock.
Unlocks: materiality, stated response, full audit trail. Ceiling removed.
Source ceiling
- actor name
- victim claim
- ransom/leak status
- discovery date
- materiality
- notification
- affected count
- confirmed data types
- compliance clock
The ✕ fields stay blank until a regulatory filing or victim disclosure lands.