AccidentalMisconfigurationCustomer Data InvolvedPHIHEALTH_BASICIDENTITY_BASICLowContained
Wellfleet Group, LLC
bd_702c49853db45dd8 · schema v1 · pii pii-v1
Full breach record for Wellfleet Group, LLC →Wellfleet Group, LLC, a third-party administrator for student health insurance plans, disclosed a data security incident on October 11, 2024. On August 1, 2024, a website misconfiguration allowed deep-links to medical referral pages to be indexed by search engines without authentication. This exposed PHI including names, DOBs, and medical diagnoses. Wellfleet engaged third-party experts, fixed the misconfiguration, and offered 24 months of credit monitoring.
Vermont clock✗ VT AG >45 bday10 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
This filing is one of 5 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (4) · sorted by filing gap
- bd_b3b97e27a29f8c61Montana State AGfiled 2024-10-11Verified
- bd_e802c5df9583d5f0California State AGfiled 2024-10-11Verified
- bd_79666de62511cf32HHS OCRfiled 2024-10-08(3d gap)Verified
- bd_13dbd31fe1337adeCalifornia State AGfiled 2024-11-11(31d gap)Verified
Source provenance
- Source URL
- https://ago.vermont.gov/document/2024-10-11-wellfleet-group-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Oct 11, 2024
- Raw hash
- da1d6e072144336e7d51e02b89de531dcf67f9bc32494cf216bb5789d66532dd
Reporting entity
- Name
- Wellfleet Group, LLCnorm: wellfleet group
Victim entity
- Name
- Wellfleet Group, LLCnorm: wellfleet group
Incident
- Discovered
- Aug 1, 2024
- Materiality determined
- —
- Notification sent
- Oct 11, 2024
- Affected individuals
- Not disclosed
- Data types
- PHIHEALTH_BASICIDENTITY_BASIC
- Attack vector
- Misconfiguration
- MITRE ATT&CK
- T1190 Exploit Public-Facing Application
Compliance
- Time to disclose
- 10 weeks(71 days from discovery to filing)
- Compliance flags
- VT AG >45 bday
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.