HackingTechnologyInformationVulnerability ExploitCapture Stored DataTargetedData ExfiltratedPIIIdentity (basic)Financial accountFinancial credentialsLowActive

Rethink

bd_93506b4b97f79ecf · schema v1 · pii pii-v1

Severity

Low

Discovered

Jul 11, 2017

Filed

Sep 6, 2017

To disclose

8 weeks

Affected

8state residents only

Linked

2 filings

Confidence

65%

Full breach record for Rethink →

The reThink Group, Inc. disclosed a data breach occurring between July 11 and August 4, 2017. A network intruder uploaded malicious code to the company's operating system, gaining access to customer names, addresses, credit card numbers, CVVs, and expiration dates. The company disabled the code, engaged Experian for identity theft protection services, and is implementing further safeguards.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 8 weeks / 57 days

Jul 11, 2017

Begins

Jul 11, 2017

Discovered

Sep 6, 2017

Filed

vs. sector median

10 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

New Hampshire State AGbd_6a32fc18018c60b52017-09-06Verified

Name: Rethink
norm: rethink
Domain: webapp.rethinkbehavioralhealth.com

Name: Rethink
norm: rethink
Domain: webapp.rethinkbehavioralhealth.com
Industry: Technologyllm

Discovered: Jul 11, 2017
Breach occurred: Jul 11, 2017 – Aug 4, 2017
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 8state-resident count only
Data types: PIIIdentity (basic)Financial accountFinancial credentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1056 Input Capture
Threat actor: ExternalFinancial
Initial access: exploit_public_facing

During the incident: Took immediate action to disable the malicious code
Prevented exposure of additional data
Continue to investigate this incident
Implementing safeguards to prevent similar intrusions
Retained Experian to provide 12 months of Identity Restoration service
Changes made: Implementing safeguards to prevent similar intrusions
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(57 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

New Hampshire State AGSep 6 · first

Montana State AGSep 6 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/reThink-Group.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 6, 2017
Raw hash: b8840dcf2a74e6d40e648e9a72ff70796f849d45e94f4ff8334bf86c358343a2

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityRethink

Victim entityRethink

Incidentdiscovered Jul 11, 2017

Stated responseTook immediate action to disable the malicious code

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov