HackingHealthcareHealthcareStolen CredentialsCustomer Data InvolvedTargetedPIIIdentity (basic)Government IDPHIHealth (basic)Financial accountMediumContained

Allwell Behavioral Health Services

bd_8a31afbb18f198e7 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 5, 2022

Filed

May 23, 2022

To disclose

11 weeks

Affected

2state residents only

Linked

6 filings

Confidence

66%

Full breach record for Allwell Behavioral Health Services →

Allwell Behavioral Health Services notified Montana residents of a data breach discovered on March 5, 2022. An outside party accessed a quality assurance system on or about March 2, 2022, potentially exposing client PII, PHI, SSNs, and payment info. No evidence of misuse was found. The company engaged forensic experts, upgraded security, notified HHS OCR and law enforcement, and offered credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 3 days

discovery → filing · 11 weeks / 79 days

Mar 2, 2022

Begins

Mar 5, 2022

Discovered

May 23, 2022

Filed

vs. sector median

+2 wks slower

This filing is one of 6 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

New Hampshire State AGbd_1610d89e5dc2f00a2022-05-23Verified
Maine State AGbd_6c239ce3cc969d622022-05-23Verified
Indiana State AGbd_785b12a92dcec05e2022-05-23Verified
HHS OCRbd_b5f444a97d3bf5612022-05-23Verified

Show 1 more filing ↓up to 1d gap

Massachusetts State AGbd_d185f8dde0973d762022-05-24 · +1dVerified

Name: Allwell Behavioral Health Services
norm: allwell behavioral health
Domain: allwell.org

Name: Allwell Behavioral Health Services
norm: allwell behavioral health
Domain: allwell.org
Industry: Healthcarellm

Discovered: Mar 5, 2022
Breach occurred: Mar 2, 2022
Undetected for: 3 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 23, 2022
Affected individuals: 2state-resident count only
Data types: PIIIdentity (basic)Government IDPHIHealth (basic)Financial account
Data elements: Social Security numberDate of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: External
Regulator citations: Notified federal law enforcement authoritiesNotified the U.S. Department of Health and Human Services Office for Civil Rights
Initial access: valid_credentials

During the incident: Took steps to secure computer systems
Began an investigation with the help of cybersecurity experts
Upgraded information technology and computer systems to provide additional security
Notified federal law enforcement authorities
Notified the U.S. Department of Health and Human Services Office for Civil Rights
Offered identity theft protection services through IDX
Changes made: Upgraded information technology and computer systems to provide additional security to protect against further unauthorized access
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 11 weeks(79 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

New Hampshire State AGMay 23 · first

Maine State AGMay 23 · first

Indiana State AGMay 23 · first

HHS OCRMay 23 · first

Montana State AGMay 23 · first · this page

Massachusetts State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-Notification-Letter-352.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 23, 2022
Raw hash: b978533cd7dc47c8f7ca3bceea5052e9251ead90727bf4e4114d0b8de6750700

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityAllwell Behavioral Health Services

Victim entityAllwell Behavioral Health Services

Incidentdiscovered Mar 5, 2022

Stated responseTook steps to secure computer systems

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov