MalwareHealthcareHealthcareRansomwareData EncryptedEmployee Data InvolvedIdentity (basic)Government IDFinancial accountPHIHealth (basic)MediumContained

Road To Hana, Inc.

bd_6e5e0f5ecc82d5e1 · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Oct 3, 2025

To disclose

—

Affected

Not disclosed

Confidence

66%

Full breach record for Road To Hana, Inc. →

Road To Hana, Inc. d/b/a Healthy Living suffered a ransomware attack on September 22, 2025, where a threat actor accessed a local server containing employee PII, including names, addresses, SSNs, direct deposit info, and medical records. The threat was neutralized and the server shut down. No evidence of misuse was found. Notices were sent to staff on September 30, 2025.

J jump to incidentP pin to compareR raw source

Incident timeline

Sep 22, 2025

Begins

Oct 3, 2025

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: Road To Hana, Inc.
norm: road to hana

Name: Road To Hana, Inc.
norm: road to hana
Also named: Road To Hana, Inc.dba oflegal entity
Healthy Livingdba oftrade name
Industry: Healthcarellm

Discovered: —
Breach occurred: Sep 22, 2025 – Sep 22, 2025
Materiality determined: —
Notification sent: Sep 30, 2025
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDFinancial accountPHIHealth (basic)
Data elements: Social Security numberMedical information
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for Impact
Threat actor: ExternalFinancial

During the incident: Working with managed services provider to secure systems and investigate
Neutralized the threat
Shut down all access to the affected server
Performed deep scan of accessed files
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ago.vermont.gov/document/2025-10-03-road-hana-dba-healthy-living-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 3, 2025
Raw hash: fbdf5e38abb866aa2fc613623b7afbbca8120233c1d9725c5f06fd52e46b5d50

Reporting entityRoad To Hana, Inc.

Victim entityRoad To Hana, Inc.

IncidentRansomware

Stated responseWorking with managed services provider to secure systems and investigate

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceago.vermont.gov