HackingHealthcareTechnologyHealthcareVulnerability ExploitCapture Stored DataZero-DaySupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedDownstream VictimsPIIIdentity (basic)Government IDMediumContained

Brightline

bd_954187ed06e346b7 · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Apr 12, 2023

To disclose

—

Affected

Not disclosed

Linked

26 filings

Confidence

77%

Full breach record for Brightline →

Brightline, Inc., a virtual behavioral health provider, notified affected individuals of a data security incident involving Fortra's GoAnywhere MFT SaaS, a third-party file transfer service. On January 30, 2023, Fortra discovered suspicious activity; an unauthorized party exploited a previously-unknown vulnerability to access customer accounts and download files. Brightline learned of the incident on February 4, 2023. Exposed data included names, addresses, member IDs, dates of birth, phone numbers, employer names, group IDs, coverage dates, and for some, Social Security numbers. Brightline responded by rebuilding infrastructure, restricting access, and offering 2 years of credit monitoring via Cyberscout.

J jump to incidentP pin to compareR raw source

Incident timeline

Jan 30, 2023

Begins

Apr 12, 2023

Filed

This filing is one of 26 about the same incident.View merged incident

Part of FORTRA, LLC supply-chain incident (2023) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

Vermont State AGbd_5ea7d3fbb2a5464a2023-04-19 · +7dVerified
HHS OCRbd_a0176e4142b0a3702023-04-20 · +8dVerified
California State AGbd_a1b16fb406ed3ce92023-04-21 · +9dVerified
Oregon State AGbd_163db05cc4cb89582023-05-02 · +20dVerified by operator

Show 6 more filings ↓up to 44d gap

California State AGbd_0868c3f9cf5006022023-05-10 · +28dVerified
HHS OCRbd_4c63e3855981b1222023-05-10 · +28dVerified
Maine State AGbd_b69375073a6e96d42023-05-10 · +28dVerified
California State AGbd_d59ed55c5ee4770a2023-05-12 · +30dVerified
California State AGbd_bf99fc2a4df4a34d2023-05-17 · +35dVerified
HHS OCRbd_f567c60a6fd57cc42023-05-26 · +44dVerified

Showing first 10 of 25 linked disclosures.

Name: Brightline
norm: brightline
Domain: hellobrightline.com

Name: Brightline
norm: brightline
Domain: hellobrightline.com
Industry: HealthcarellmTechnologyllm

Discovered: —
Breach occurred: Jan 30, 2023
Materiality determined: —
Notification sent: Apr 7, 2023
Affected individuals: Not disclosed
Data types: PIIIdentity (basic)Government ID
Data elements: Social Security numberDate of birth
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1195 Supply Chain CompromiseT1530 Data from Cloud Storage Object
Threat actor: External
Third party: via Fortra (formerly HelpSystems)
Initial access: exploit_public_facing

During the incident: Confirmed Fortra deactivated the unauthorized user's credentials
Disabled the vulnerable java servlet
Rebuilt Brightline's instance on new infrastructure
Implemented a whitelisting for limited IP addresses to access the previously vulnerable administrative portal
Removal of all Brightline data from the GoAnywhere MFT SaaS
Retained cyber counsel to assist with our investigation
Fortra promptly notified law enforcement and is cooperating with their investigation of the GoAnywhere incident
Began to analyze the files to determine which individuals and data had been affected
Changes made: Ongoing measures to reduce data exposure until an alternative file transfer solution is identified and implemented
We continue to enhance our cybersecurity program to further safeguard our systems from cyber threats
Secured the services of Cyberscout to provide identity theft restoration and credit monitoring services at no cost for 2 years
Providing access to Single Bureau Credit Monitoring / Single Bureau Credit Report / Single Bureau Credit Score services at no charge
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 4 states

View merged incident ↗

California State AGApr 12 · first · this page

Vermont State AG+7d

HHS OCR+8d

California State AG+9d

Oregon State AG+20d

California State AG+28d

HHS OCR+28d

Maine State AG+28d

California State AG+30d

California State AG+35d

HHS OCR+44d

Pattern: first filing Apr 12 (CA), last May 26 (CA) — a 44-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Cascade drawn from the first 10 linked disclosures of 25 — the full spread may be wider.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-565472
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 12, 2023
Raw hash: 15bd9c9f1917a5c377d89064be788087ddd28fa7d25831211758d54fb5a42d33

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entityBrightline

Victim entityBrightline

IncidentThird-Party / Supply Chain

Stated responseConfirmed Fortra deactivated the unauthorized user's credentials

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov