HackingHealthcareHealthcareData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDHealth (basic)Financial accountCriticalContained

Asheville Eye Associates, PLLC

bd_93dc0cb8a1a6d331 · schema v1 · pii pii-v1

Severity

Critical

Discovered

Nov 18, 2024

Filed

Jun 13, 2025

To disclose

30 weeks

Affected · nationwide

147,11635 in this filing

Linked

11 filings

Confidence

66%

Full breach record for Asheville Eye Associates, PLLC →

Asheville Eye Associates, PLLC, a healthcare provider, reported an external system breach (hacking) on November 18, 2024. The incident affected 147,116 individuals, including 35 Maine residents. Compromised data included names, addresses, SSNs, medical treatment info, and health insurance info. The company engaged forensic specialists, notified law enforcement, and provided 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Nov 18, 2024 → Filed with AG Jun 13, 2025207d ✗ ME AG >90d30 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 30 weeks / 207 days

Nov 18, 2024

Begins

Nov 18, 2024

Discovered

Jun 13, 2025

Filed

vs. sector median

+18 wks slower

This filing is one of 11 about the same incident.View merged incident

A leak claim by dragonforce about this victim predates this filing by 207 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (2)

Leak Sitedragonforcebd_8e9f39a1a6b441862024-12-28 · +167dVerified by operator
Leak Sitedragonforcebd_531afc24c6d789e32024-11-18 · +207dVerified by operator

Regulatory filings (8) · sorted by filing gap

Massachusetts State AGbd_2a6ba17735f3a05c2025-06-13Verified by operator
Montana State AGbd_5d1589dd656b977a2025-06-13Verified by operator
Indiana State AGbd_61636977e5587fea2025-06-13Verified by operator
Vermont State AGbd_66c3cf170bf79f252025-06-13Verified by operator

Show 4 more filings ↓up to 147d gap

South Carolina State AGbd_694b2250a9e049d12025-06-13Verified by operator
Nebraska State AGbd_a123f9478c637f5d2025-06-13Verified
New Hampshire State AGbd_fc537b31025714952025-06-13Verified by operator
HHS OCRbd_852df6b2e42b269a2025-01-17 · +147dVerified by operator

Name: Asheville Eye Associates, PLLC
norm: asheville eye associates
Domain: ashevilleeye.com

Name: Asheville Eye Associates, PLLC
norm: asheville eye associates
Domain: ashevilleeye.com
Industry: Healthcarellm

Discovered: Nov 18, 2024
Breach occurred: Nov 18, 2024
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 13, 2025
Affected individuals: 147,116state + nationwide
Data types: Identity (basic)Government IDHealth (basic)Financial account
Data elements: Social Security numberMedical information
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Filed notification with Maine Attorney General
Initial access: exploit_public_facing

During the incident: Engaged third-party specialists to assist with securing the network environment and investigating the incident
Reported the incident to law enforcement
Changes made: Implemented measures to further enhance the security of the network environment
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 30 weeks(207 days from discovery to filing)
Compliance flags: ME AG >90d · 207dLeak >180dME resident >60d · 207d
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Nov 18, 2024
→ Filed with AG: Jun 13, 2025
207d 90 days ME AG >90d
Maine
Discovered: Nov 18, 2024
→ Notified: Jun 13, 2025
207d 60 days (analyst band; statutory cap is 30 days) ME resident >60d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Nov 18, 2024 → Filed with AG: Jun 13, 2025	207d	90 days	ME AG >90d
Maine	Discovered: Nov 18, 2024 → Notified: Jun 13, 2025	207d	60 days (analyst band; statutory cap is 30 days)	ME resident >60d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 9 filings · 9 states

View merged incident ↗

HHS OCRJan 17 · first

Massachusetts State AG+147d

Montana State AG+147d

Indiana State AG+147d

Vermont State AG+147d

South Carolina State AG+147d

Nebraska State AG+147d

New Hampshire State AG+147d

Maine State AG+147d · this page

Pattern: first filing Jan 17 (NC), last Jun 13 (ME) — a 147-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/c4455141-8d8a-4179-8be8-49ce21a2a97f.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 13, 2025
Raw hash: b26250edc857aa4965c131a87a2349c07366feecb3bdb9f2ff68b69cc1388539

Linked disclosures

Ransomware claims (2)

Regulatory filings (8) · sorted by filing gap

Reporting entityAsheville Eye Associates, PLLC

Victim entityAsheville Eye Associates, PLLC

Incidentdiscovered Nov 18, 2024

Stated responseEngaged third-party specialists to assist with securing the network environment and investigating the incident

ComplianceME AG >90d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov