MalwareTechnologyHealthcareInformationRansomwareStolen CredentialsData ExfiltratedCustomer Data InvolvedEmployee Data InvolvedAuthenticationEmploymentFinancial accountHealth (basic)Identity (basic)Government IDPHIHighContained

HENRY SCHEIN, INC.

bd_72816974130743b6 · schema v1 · pii pii-v1

Severity

High

Discovered

Oct 14, 2023

Filed

Jan 26, 2024

To disclose

15 weeks

Affected

1,953state residents only

Linked

9 filings

Confidence

70%

Full breach record for HENRY SCHEIN, INC. →6 incidents on file

Henry Schein, Inc. filed a supplemental notice with the Washington AG regarding a ransomware incident. The breach impacted 1,953 Washington residents, including employee PII (SSNs, DOBs, financial/medical data). Incident occurred Sept-Dec 2023; discovered Oct 14, 2023. Notices sent starting Nov 17, 2023. Remediation included forensic investigation and credit monitoring offers.

J jump to incidentP pin to compareR raw source

Washington clock✗ WA AG >90d15 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 17 days

discovery → filing · 15 weeks / 104 days

Sep 27, 2023

Begins

Oct 14, 2023

Discovered

Jan 26, 2024

Filed

vs. sector median

4 wks faster

This filing is one of 9 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (8) · sorted by filing gap

California State AGbd_4b1727b048fdc8552023-12-06 · +51dVerified
Maine State AGbd_817f39c882aae4e02023-12-06 · +51dVerified
Massachusetts State AGbd_9a93e1de11d7d9732023-12-06 · +51dVerified
South Carolina State AGbd_e6ff33d71b709e982023-11-28 · +59dVerified

Show 4 more filings ↓up to 71d gap

Montana State AGbd_6c3ca5d013cd7be22023-11-17 · +70dVerified
Vermont State AGbd_cc87b9a5cdf301c12023-11-17 · +70dVerified
SEC 8-Kbd_838851b9407ab0032023-11-16 · +71dVerified
New Hampshire State AGbd_ad54e6e188668b372023-11-16 · +71dVerified

Name: HENRY SCHEIN, INC.
norm: henry schein
Domain: henryschein.com

Name: HENRY SCHEIN, INC.
norm: henry schein
Domain: henryschein.com
Industry: TechnologyllmHealthcarellm

Discovered: Oct 14, 2023
Breach occurred: Sep 27, 2023 – Dec 5, 2023
Undetected for: 17 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 17, 2023
Affected individuals: 1,953state-resident count only
Data types: Identity (basic)Government IDFinancial accountHealth (basic)Employment
Data elements: NameSocial Security numberDriver's licence numberFinancial account numberDate of birthPassport numberHealth insurance IDMedical informationUsername + password
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 1-99dexposure 1-99d
WA-stated discovery: Found while ongoing
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified Washington Attorney General
Initial access: valid_credentials

During the incident: Took certain systems offline
Notified relevant law enforcement authorities
Engaged outside cybersecurity and forensic information technology experts
Conducted an investigation to identify and remove any malicious files
Offered complimentary 24-month membership to Experian’s IdentityWorks
Changes made: Implementing measures to fortify defenses going forward
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 15 weeks(104 days from discovery to filing)
Compliance flags: WA AG >90d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 9 filings · 8 states

View merged incident ↗

SEC 8-KNov 16 · first

New Hampshire State AGNov 16 · first

Montana State AG+1d

Vermont State AG+1d

South Carolina State AG+12d

California State AG+20d

Maine State AG+20d

Massachusetts State AG+20d

Washington State AG+71d · this page

Pattern: first filing Nov 16, last Jan 26 (WA) — a 71-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27714.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 26, 2024
Raw hash: 50da7d2686a8f45e7d1f174cd0d7ec485c7b20a52b59b59eeaaed241529c3c03

Linked disclosures

Regulatory filings (8) · sorted by filing gap

Reporting entityHENRY SCHEIN, INC.

Victim entityHENRY SCHEIN, INC.

Incidentdiscovered Oct 14, 2023

Stated responseTook certain systems offline

ComplianceWA AG >90d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com