HackingHealthcareRetail & ConsumerHealthcareCustomer Data InvolvedTargetedPIIIdentity (basic)CredentialsMediumContained

Apria Healthcare LLC

bd_95d978c59636df32 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 1, 2021

Filed

May 31, 2023

To disclose

21 months

Affected

8,566state residents only

Linked

10 filings

Confidence

66%

Full breach record for Apria Healthcare LLC →6 incidents on file

Apria Healthcare LLC notified New Hampshire residents of a security incident where an unauthorized third party accessed systems containing personal information between April 2019 and October 2021. The actor's intent was financial fraud; no evidence of funds removal or data exfiltration was found. 8,566 NH residents were affected. Apria engaged the FBI and forensic investigators, implemented security measures, and offered 12 months of Kroll identity protection services.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 880 days

discovery → filing · 21 months / 637 days

Apr 5, 2019

Begins

Sep 1, 2021

Discovered

May 31, 2023

Filed

vs. sector median

+79 wks slower

This filing is one of 10 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (9) · sorted by filing gap

South Carolina State AGbd_51e8800d8028d4c02023-05-23 · +8dVerified
Massachusetts State AGbd_1f701cba90e72cd52023-05-22 · +9dVerified
Indiana State AGbd_2e2c65b37bdc95c62023-05-22 · +9dVerified
Oregon State AGbd_484942091b9acd622023-05-22 · +9dCandidate

Show 5 more filings ↓up to 9d gap

Delaware State AGbd_a0195e3f90a18f772023-05-22 · +9dVerified
Maine State AGbd_a2be55087df281902023-05-22 · +9dVerified
Montana State AGbd_c1a512d17d99444f2023-05-22 · +9dVerified
California State AGbd_ca14fb87d20497f22023-05-22 · +9dVerified
Washington State AGbd_e12921387568e40f2023-05-22 · +9dVerified

Name: Apria Healthcare LLC
norm: apria healthcare
Domain: apriahome.com

Name: Apria Healthcare LLC
norm: apria healthcare
Domain: apria.com
Industry: HealthcarellmRetail & Consumerllm

Discovered: Sep 1, 2021
Breach occurred: Apr 5, 2019 – Oct 10, 2021
Undetected for: 880 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 22, 2023
Affected individuals: 8,566state-resident count only
Data types: PIIIdentity (basic)Credentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: working with the Federal Bureau of Investigation
Initial access: exploit_public_facing

During the incident: Working with the Federal Bureau of Investigation
Hiring a reputable forensic investigation team to investigate and securely resolve the incident
Implemented additional security measures upon the guidance and recommendation of our forensic investigators
Arranged for impacted individuals to enroll in identity protection services from Kroll
Changes made: Implemented additional security measures upon the guidance and recommendation of our forensic investigators to help prevent the reoccurrence of a similar breach
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 21 months(637 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 10 filings · 10 states

View merged incident ↗

Massachusetts State AGMay 22 · first

Indiana State AGMay 22 · first

Oregon State AGMay 22 · first

Delaware State AGMay 22 · first

Maine State AGMay 22 · first

Montana State AGMay 22 · first

California State AGMay 22 · first

Washington State AGMay 22 · first

South Carolina State AG+1d

New Hampshire State AG+9d · this page

Pattern: first filing May 22 (MA), last May 31 (NH) — a 9-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/apria-healthcare-20230531.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 31, 2023
Raw hash: cc9b6c4364e3df650cbefec2cd6db0ee09cabdac535e107b830421ac85224c3f

Linked disclosures

Regulatory filings (9) · sorted by filing gap

Reporting entityApria Healthcare LLC

Victim entityApria Healthcare LLC

Incidentdiscovered Sep 1, 2021

Stated responseWorking with the Federal Bureau of Investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov