HackingHealthcareTechnologyHealthcareStolen CredentialsCapture Stored DataData ExfiltratedCustomer Data InvolvedDownstream VictimsIdentity (basic)Health (basic)Government IDPHIMediumContained

EpiSource

bd_86be71a38f1e4e1d · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 6, 2025

Filed

Jul 14, 2025

To disclose

23 weeks

Affected

4state residents only

Linked

24 filings

Confidence

66%

Full breach record for EpiSource →4 incidents on file

Episource, LLC, a medical coding and risk adjustment services provider, notified the New Hampshire Attorney General of a data security event. Unauthorized access occurred between Jan 27 and Feb 6, 2025, involving PHI, SSNs, and contact info for patients of Episource's healthcare clients. Episource detected the incident on Feb 6, 2025, engaged forensic investigators, and notified law enforcement. Notices were mailed to 4 NH residents on July 11, 2025.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 10 days

discovery → filing · 23 weeks / 158 days

Jan 27, 2025

Begins

Feb 6, 2025

Discovered

Jul 14, 2025

Filed

vs. sector median

+12 wks slower

This filing is one of 24 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

New Hampshire State AGbd_a2b82676192bff452025-09-15 · +63dVerified by operator
California State AGbd_9fdbc50e284e387e2025-09-22 · +70dVerified by operator
California State AGbd_f7b2fef6a5a68d492025-10-01 · +79dVerified by operator
California State AGbd_9fbf33f1d80fd6cd2025-10-15 · +93dVerified by operator

Show 6 more filings ↓up to 212d gap

California State AGbd_26b46fb1375699872025-11-12 · +121dVerified by operator
Montana State AGbd_8bfabd788a54c7dd2025-11-12 · +121dVerified by operator
Oregon State AGbd_a777c7526ecf94bd2025-12-11 · +150dVerified by operator
California State AGbd_e03b6cfce712071e2026-02-09 · +210dVerified by operator
New Hampshire State AGbd_5f78056b95d71c8e2026-02-10 · +211dVerified by operator
Texas State AGbd_902d3567da6db0052026-02-11 · +212dVerified by operator

Showing first 10 of 23 linked disclosures.

Name: EpiSource
norm: episource

Name: EpiSource
norm: episource
Industry: HealthcarellmTechnologyllm

Discovered: Feb 6, 2025
Breach occurred: Jan 27, 2025 – Feb 6, 2025
Undetected for: 10 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 11, 2025
Affected individuals: 4state-resident count only
Data types: Identity (basic)Health (basic)Government IDPHI
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: Notified Office of the New Hampshire Attorney General
Initial access: valid_credentials

During the incident: Took steps to contain the threat
Disconnected and turned off systems
Engaged a third-party forensic firm to investigate the event and assist with remediation efforts
Notified law enforcement
Changes made: Further enhanced its security and monitoring practices
Further strengthened its systems to minimize the risk that a similar event occurs in the future
Offering free credit monitoring and identity protection services
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 23 weeks(158 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 5 states

View merged incident ↗

New Hampshire State AGJul 14 · first · this page

New Hampshire State AG+63d

California State AG+70d

California State AG+79d

California State AG+93d

California State AG+121d

Montana State AG+121d

Oregon State AG+150d

California State AG+210d

New Hampshire State AG+211d

Texas State AG+212d

Pattern: first filing Jul 14 (NH), last Feb 11 (TX) — a 212-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Cascade drawn from the first 10 linked disclosures of 23 — the full spread may be wider.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/episource-20250714.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 14, 2025
Raw hash: 95dbddc304cdaaea201b2ad0c33c0e9755eda28fd29d8763767ab3660552d826

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entityEpiSource

Victim entityEpiSource

Incidentdiscovered Feb 6, 2025

Stated responseTook steps to contain the threat

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov