HackingHealthcareHealthcareCustomer Data InvolvedPIIPHIIdentity (basic)Health (basic)LowContained

MedImpact Healthcare

bd_935b807df52a877a · schema v1 · pii pii-v2

Severity

Low

Discovered

Oct 18, 2025

Filed

Sep 15, 2026

To disclose

47 weeks

Affected

Not disclosed

Linked

6 records

Confidence

68%

Full breach record for MedImpact Healthcare →

MedImpact Healthcare Systems, Inc., a pharmacy benefits manager, identified unauthorized activity in its systems on October 18, 2025. The company secured affected systems and engaged cybersecurity experts. Personal information, including names and potentially health-related data, was involved. No evidence of misuse was found. MedImpact enhanced security safeguards.

J jump to incidentP pin to compareR raw source

Leak gap clock✗ Leak >180d47 weeks discovery → filing

Incident timeline

discovery → filing · 47 weeks / 332 days

Oct 18, 2025

Begins

Oct 18, 2025

Discovered

Sep 15, 2026

Filed

vs. sector median

+38 wks slower

This filing is one of 6 records about the same incident.View merged incident

A leak claim by qilin about this victim was first seen 323 days before this filing.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Siteqilinbd_b1db918e771e4fe92025-10-12 · +338dVerified

Regulatory filings (4) · sorted by filing gap

California State AGbd_14e2f6ba42db654b2026-09-25 · +10dVerified
Oregon State AGbd_3392b05e9b0f70902026-09-26 · +11dVerified
Texas State AGbd_051c407f829eb5812026-09-29 · +14dVerified
Massachusetts State AGbd_d1d5a4ce84c29d9b2026-09-01 · +14dCandidate

Name: MedImpact Healthcare Systems, Inc.
norm: medimpact healthcare systems
Domain: leggett.com

Name: MedImpact Healthcare
norm: medimpact healthcare
Domain: medimpact.com
Industry: Healthcarellm

Discovered: Oct 18, 2025
Breach occurred: Oct 18, 2025
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: PIIPHIIdentity (basic)Health (basic)
Attack vector: Unknown

During the incident: Took steps to secure the affected systems
Engaged cybersecurity experts to assist in the investigation and response to the incident
Conducted a detailed review of data potentially impacted by the incident
Changes made: Taken steps to further enhance its security safeguards and monitoring
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 47 weeks(332 days from discovery to filing)
Compliance flags: Leak >180d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 4 states

View merged incident ↗

Massachusetts State AGSep 1 · first

California State AG+14d · this page

California State AG+24d

Oregon State AG+25d

Texas State AG+28d

Pattern: first filing Sep 1 (MA), last Sep 29 (TX) — a 28-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-629789
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 15, 2026
Raw hash: bcbaec2b64cb230b491567fc404e298aa0e5ba67857452e5d7a30a3f4cfcf820

Linked disclosures

Ransomware claims (1)

Regulatory filings (4) · sorted by filing gap

Reporting entityMedImpact Healthcare Systems, Inc.

Victim entityMedImpact Healthcare

Incidentdiscovered Oct 18, 2025

Stated responseTook steps to secure the affected systems

ComplianceLeak >180d

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov