HackingTechnologyHealthcareInformationData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDHealth (basic)Financial accountMediumContained

Comstar LLC

bd_7e62f29ad917b45d · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 26, 2022

Filed

May 25, 2022

To disclose

9 weeks

Affected

45state residents only

Linked

13 records

Confidence

64%

Full breach record for Comstar LLC →

Comstar, LLC notified individuals of a cyber-attack discovered on March 26, 2022, involving unauthorized access to servers. Potentially impacted data included names, SSNs, DOBs, medical info, and financial accounts. Comstar engaged third-party experts, notified law enforcement, and offered credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 9 weeks / 60 days

Mar 26, 2022

Discovered

May 25, 2022

Filed

vs. sector median

2 wks faster

This filing is one of 13 records about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (9) · sorted by filing gap

Indiana State AGbd_662700170b2a610b2022-05-25Verified
HHS OCRbd_7c3a134ab345e7362022-05-26 · +1dVerified
New Hampshire State AGbd_0db5d3b9a664394c2022-05-27 · +2dVerified
California State AGbd_85177613717390c12022-06-14 · +20dVerified

Show 5 more filings ↓up to 93d gap

Maine State AGbd_b95db5904d98be342022-06-30 · +36dVerified
California State AGbd_d818ee99f86b12dd2022-06-30 · +36dVerified
Maine State AGbd_1a59883a0195e6ff2022-08-22 · +89dVerified
California State AGbd_464f9d9da319c0212022-08-22 · +89dVerified
New Hampshire State AGbd_b57b40825eebd8b32022-08-26 · +93dVerified by operator

Enforcement records (1)

HHS OCR enforcementbd_431a2323ea15d5c32025-05-30 · +1101dVerified by operator

Showing first 10 of 12 linked disclosures.

Name: Comstar Technologies, LLC
norm: comstar technologies
Domain: comstarbilling.com

Name: Comstar LLC
norm: comstar
Domain: comstarbilling.com
Industry: TechnologyllmHealthcarellm

Discovered: Mar 26, 2022
Materiality determined: —
Notification sent: —
Affected individuals: 45state-resident count only
Data types: Identity (basic)Government IDHealth (basic)Financial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: notified law enforcementreporting to state and federal regulatory officials

During the incident: Took steps to secure our network
Launched a thorough investigation, with the assistance of third-party experts
Reviewed the contents of those files to determine what information was contained therein
Offering you access to credit monitoring and identity theft restoration services through Equifax at no cost
Notified law enforcement and is cooperating with the investigation
Reporting to state and federal regulatory officials
Changes made: Reviewing those existing policies and procedures to further protect against similar incidents moving forward
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(60 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 10 filings · 6 states

View merged incident ↗

Indiana State AGMay 25 · first

Montana State AGMay 25 · first · this page

HHS OCR+1d

New Hampshire State AG+2d

California State AG+20d

Maine State AG+36d

California State AG+36d

Maine State AG+89d

California State AG+89d

New Hampshire State AG+93d

Pattern: first filing May 25 (IN), last Aug 26 (NH) — a 93-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Cascade drawn from the first 10 linked disclosures of 12 — the full spread may be wider.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/Comstar-LLC-Consumer-Notification-Letter.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 25, 2022
Raw hash: 63b32aea0f06c20fb203c0403dc9236d09748e7937a69b186adfb6035afadede

Linked disclosures

Regulatory filings (9) · sorted by filing gap

Enforcement records (1)

Reporting entityComstar Technologies, LLC

Victim entityComstar LLC

Incidentdiscovered Mar 26, 2022

Stated responseTook steps to secure our network

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov