HackingHealthcareTechnologyHealthcareVulnerability ExploitCapture Stored DataData ExfiltratedTargetedIdentity (basic)Government IDPHIHealth (basic)MediumContained

Mass General Brigham Health Plan

bd_734395d7c329bf9c · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 26, 2023

Filed

Nov 21, 2023

To disclose

17 weeks

Affected

9state residents only

Confidence

65%

Full breach record for Mass General Brigham Health Plan →3 incidents on file

Welltok, Inc. notified Mass General Brigham Health Plan (MGBHP) that an unknown actor exploited vulnerabilities in the MOVEit Transfer server on May 30, 2023, exfiltrating data including names, DOBs, SSNs, and PHI. The incident was detected on July 26, 2023. Notices were sent on November 20, 2023. Credit monitoring was offered.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 57 days

discovery → filing · 17 weeks / 118 days

May 30, 2023

Begins

Jul 26, 2023

Discovered

Nov 21, 2023

Filed

vs. sector median

+4 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed9 affectedView incident

Name: Welltok, Inc.
norm: welltok
Domain: massgeneralbrighamhealthplan.org

Name: Mass General Brigham Health Plan
norm: mass general brigham health plan
Domain: massgeneralbrighamhealthplan.org
Industry: HealthcarellmTechnologyllm

Discovered: Jul 26, 2023
Breach occurred: May 30, 2023
Undetected for: 57 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 20, 2023
Affected individuals: 9state-resident count only
Data types: Identity (basic)Government IDPHIHealth (basic)
Data elements: Social Security numberDate of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Initial access: exploit_public_facing

During the incident: Moved quickly to investigate and respond to the event
Engaged third-party cybersecurity specialists
Conducted examination of systems and networks
Undertook detailed reconstruction and review of data stored on the server
Coordinated efforts with MGBHP to review and verify affected information
Provided direct notice to impacted individuals
Offering complimentary access to Experian IdentityWorks
Changes made: Reviewing and enhancing existing policies and procedures related to data privacy
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 17 weeks(118 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-notification-letter-878.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 21, 2023
Raw hash: 87e0905b306183d58eb9c9bc9d565ea5d743647859181235d99770616e2eb603

Reporting entityWelltok, Inc.

Victim entityMass General Brigham Health Plan

Incidentdiscovered Jul 26, 2023

Stated responseMoved quickly to investigate and respond to the event

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov