MalwareRansomwareStolen CredentialsData ExfiltratedCustomer Data InvolvedDelayed DiscoveryPIIPHIIDENTITY_BASICLowContained
HealthPlan Services, Inc.
bd_6c49de945b104101 · schema v1 · pii pii-v1
Full breach record for HealthPlan Services, Inc. →HealthPlan Services, Inc. (HPS) detected malware on its network on June 23, 2022, which allowed an unauthorized party to access and acquire files between June 22 and June 23, 2022. HPS contained the network, alerted law enforcement, and engaged cybersecurity professionals. A forensic investigation concluded in late February/March 2023 that personal information, including full names and potentially health-related data, was acquired. HPS notified affected individuals on April 28, 2023, and offered 24 months of identity theft protection.
California clockDiscovered Jun 23, 2022 → Notified Apr 28, 2023309d ✗ CA 60-day late44 weeks discovery → filing
This filing is one of 4 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (3) · sorted by filing gap
- bd_00d4ed99b87ddc54HHS OCRfiled 2023-04-28Verified
- bd_94a3989c86366ae4Maine State AGfiled 2023-04-28Verified by operator
- bd_b690a45d2dc172deMontana State AGfiled 2023-04-28Verified
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-566124
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Apr 28, 2023
- Raw hash
- 4d7793ce40c50fb0db5dd21d2c2c3168e616952ac3384832093a8efd119d312f
Reporting entity
- Name
- HealthPlan Services, Inc.norm: healthplan services
Victim entity
- Name
- HealthPlan Services, Inc.norm: healthplan services
Incident
- Discovered
- Jun 23, 2022
- Materiality determined
- —
- Notification sent
- Apr 28, 2023
- Affected individuals
- Not disclosed
- Data types
- PIIPHIIDENTITY_BASIC
- Attack vector
- Unknown
- MITRE ATT&CK
- T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
- Threat actor
- External
Compliance
- Time to disclose
- 44 weeks(309 days from discovery to filing)
- Compliance flags
- CA 60-day late · 309d
- Discovery-date grounding
- letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Jun 23, 2022→ Notified: Apr 28, 2023309d 60 days (analyst band, pre-2026 discoveries) CA 60-day late
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.