DisclosureLens
UnknownFinancial ServicesHealthcareFinanceBusiness Associate (HIPAA)Customer Data InvolvedLow

HEALTHEQUITY, INC.

bd_77c8a9acc4269789 · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Apr 17, 2025

To disclose

—

Affected

105state residents only

Linked

29 filings

Confidence

52%
Full breach record for HEALTHEQUITY, INC. →9 incidents on file

Supplemental notice filed by HealthEquity, Inc. (a HIPAA Business Associate) on behalf of Covered Entities in New Hampshire. This filing updates the count of NH residents affected by a prior data event, attributing 105 individuals to three specific entities: Ameritas Life Insurance Corp (16), BCBS Massachusetts (87), and Regence BCBS (2).

Leak gap clock✗ Leak >180d
⚠ no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.

Incident timeline — partial

? — ?

Breach window unknown

Apr 17, 2025

Filed

—

Corroborated · see linked filings

Compliance clocks stay unassessable until a regulatory filing lands. Dashed segments fill in automatically when corroboration arrives.

This filing is one of 29 about the same incident.View merged incident
A leak claim by cl0p about this victim predates this filing by 672 days.View originating leak claim

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

Show 6 more filings ↓up to 36d gap

Showing first 10 of 28 linked disclosures.

Filing propagation · 11 filings · 3 states

View merged incident ↗
New Hampshire State AGApr 17 · first · this page
New Hampshire State AG+22d
California State AG+26d
New Hampshire State AG+26d
New Hampshire State AG+28d
California State AG+28d
New Hampshire State AG+29d
California State AG+29d
Massachusetts State AG+32d
New Hampshire State AG+32d
Massachusetts State AG+36d

Pattern: first filing Apr 17 (NH), last May 23 (MA) — a 36-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Cascade drawn from the first 10 linked disclosures of 28 — the full spread may be wider.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.