MalwareRansomwareData EncryptedIDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTHEALTH_BASICMediumContained
Road To Hana, Inc.
bd_6e5e0f5ecc82d5e1 · schema v1 · pii pii-v1
Full breach record for Road To Hana, Inc. →Road To Hana, Inc. d/b/a Healthy Living notified Vermont staff on September 30, 2025, of a ransomware attack occurring on September 22, 2025. The incident involved unauthorized access to a local server potentially containing PII, SSNs, direct deposit info, and medical records. The threat was neutralized and access shut down. No evidence of misuse was found. The company is notifying staff in an abundance of caution.
Vermont clock✓ VT AG ≤14 bday11 days discovery → filing
⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident
Source provenance
- Source URL
- https://ago.vermont.gov/document/2025-10-03-road-hana-dba-healthy-living-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Oct 3, 2025
- Raw hash
- fbdf5e38abb866aa2fc613623b7afbbca8120233c1d9725c5f06fd52e46b5d50
Reporting entity
- Name
- Road To Hana, Inc.norm: road to hana
Victim entity
- Name
- Road To Hana, Inc.norm: road to hana
Incident
- Discovered
- Sep 22, 2025
- Materiality determined
- —
- Notification sent
- Sep 30, 2025
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTHEALTH_BASIC
- Attack vector
- Ransomware
- MITRE ATT&CK
- T1486 Data Encrypted for ImpactT1119 Automated Collection
- Threat actor
- ExternalFinancial
- Regulator citations
- Notified Vermont Attorney General's Office
Compliance
- Time to disclose
- 11 days(11 days from discovery to filing)
- Compliance flags
- VT AG ≤14 bday
- Discovery-date grounding
- occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.