HackingHealthcareTechnologyHealthcareVulnerability ExploitSupply Chain (3P Vendor)Data ExfiltratedIdentity (basic)Government IDHealth (basic)PHIMediumContained

CareSource

bd_6c68eb604349c96d · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 27, 2023

Filed

Aug 25, 2023

To disclose

8 weeks

Affected

Not disclosed

Linked

9 records

Confidence

66%

Full breach record for CareSource →6 incidents on file

CareSource disclosed a data breach affecting its members due to a vulnerability in Progress Software's MOVEit transfer software. The incident, discovered on June 27, 2023, involved the exfiltration of protected health information (PHI) and personally identifiable information (PII), including SSNs and health conditions. CareSource patched the software and engaged Kroll to provide two years of credit monitoring to affected individuals.

J jump to incidentP pin to compareR raw source

Vermont clock⏱ VT AG >14 bday8 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 27 days

discovery → filing · 8 weeks / 59 days

May 31, 2023

Begins

Jun 27, 2023

Discovered

Aug 25, 2023

Filed

vs. sector median

1 wks faster

This filing is one of 9 records about the same incident.View merged incident

A leak claim by cl0p about this victim was first seen 57 days before this filing.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitecl0pbd_92cee760ff4463cd2023-06-29 · +57dVerified by operator

Regulatory filings (7) · sorted by filing gap

Massachusetts State AGbd_6a936f6fd472b50c2023-08-28 · +3dVerified by operator
California State AGbd_a5a734fce487738a2023-08-28 · +3dVerified by operator
New Hampshire State AGCL0Pbd_023953673f35b8272023-08-30 · +5dVerified
Washington State AGbd_8cae43083631f0182023-08-30 · +5dVerified by operator

Show 3 more filings ↓up to 236d gap

HHS OCRbd_15516622e95b67bb2023-07-27 · +29dVerified by operator
New Hampshire State AGbd_ad59de38582addd52023-07-18 · +38dVerified by operator
Illinois State AGbd_40d83cd3b7afec812023-01-01 · +236dVerified by operator

Name: CareSource
norm: caresource
Domain: caresource.com

Name: CareSource
norm: caresource
Domain: caresource.com
Industry: HealthcarellmTechnologyllm

Discovered: Jun 27, 2023
Breach occurred: May 31, 2023
Undetected for: 27 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 25, 2023
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDHealth (basic)PHI
Data elements: Social Security numberDate of birth
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain CompromiseT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Filed notice with Vermont Attorney General
Initial access: supply_chain

During the incident: Added all patches from MOVEit
Partnered with Kroll to offer two years of credit monitoring
Conducted a full investigation
Changes made: Looking into what, if any, updated processes may be needed
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(59 days from discovery to filing)
Compliance flags: VT AG >14 bdayLeak >30d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 7 states

View merged incident ↗

Illinois State AGJan 1 · first

New Hampshire State AG+198d

HHS OCR+207d

Vermont State AG+236d · this page

Massachusetts State AG+239d

California State AG+239d

New Hampshire State AG+241d

Washington State AG+241d

Pattern: first filing Jan 1 (IL), last Aug 30 (WA) — a 241-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ago.vermont.gov/document/2023-08-25-caresource-progress-software-moveit-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 25, 2023
Raw hash: e637551c70a03fe7f561633648c0c050662f9c8b0f3cb22ced77a4c629ca164a

Linked disclosures

Ransomware claims (1)

Regulatory filings (7) · sorted by filing gap

Reporting entityCareSource

Victim entityCareSource

Incidentdiscovered Jun 27, 2023

Stated responseAdded all patches from MOVEit

ComplianceVT AG >14 bday

Extraction provenanceno artifact recorded

Source provenanceago.vermont.gov