HackingHealthcareHealthcareDelayed DiscoveryIdentity (basic)Government IDFinancial accountHealth (basic)PIIMediumActive

Healix Infusion Therapy, LLC

bd_969c784f3674d3b7 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 12, 2023

Filed

Dec 11, 2023

To disclose

13 weeks

Affected

Not disclosed

Linked

6 filings

Confidence

66%

Full breach record for Healix Infusion Therapy, LLC →

Healix Infusion Therapy, LLC notified consumers of a data breach occurring between Sept 8-12, 2023. Unauthorized access compromised PHI, SSNs, financial data, and government IDs. The company engaged forensic specialists, notified law enforcement, and offered credit monitoring. Investigation is ongoing; exact count of affected individuals is not yet determined.

J jump to incidentP pin to compareR raw source

Vermont clock✗ VT AG >45 bday13 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 4 days

discovery → filing · 13 weeks / 90 days

Sep 8, 2023

Begins

Sep 12, 2023

Discovered

Dec 11, 2023

Filed

vs. sector median

+4 wks slower

This filing is one of 6 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

HHS OCRbd_46aff5e7bb26765b2023-12-11Verified by operator
Massachusetts State AGbd_6d9804d5eb955c592023-12-11Verified by operator
South Carolina State AGbd_4f8ddf79b8ca734d2024-02-07 · +58dVerified
Montana State AGbd_8fd9d2d173685c772024-07-11 · +213dVerified

Show 1 more filing ↓up to 344d gap

Illinois State AGbd_777983e5e360cae72023-01-01 · +344dCandidate

Name: Healix Infusion Therapy, LLC
norm: healix infusion therapy

Name: Healix Infusion Therapy, LLC
norm: healix infusion therapy
Industry: Healthcarellm

Discovered: Sep 12, 2023
Breach occurred: Sep 8, 2023 – Sep 12, 2023
Undetected for: 4 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 11, 2023
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDFinancial accountHealth (basic)PII
Data elements: Social Security numberDate of birthMedical information
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified federal law enforcementNotified appropriate state and federal regulators
Initial access: valid_credentials

During the incident: Retained data privacy counsel and forensic specialists
Notified federal law enforcement
Notified appropriate state and federal regulators
Providing access to 12/24 months of credit monitoring and identity theft protection services through Equifax
Changes made: Reviewing existing security policies
Implemented additional cybersecurity measures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 13 weeks(90 days from discovery to filing)
Compliance flags: VT AG >45 bday
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Illinois State AGJan 1 · first

HHS OCR+344d

Massachusetts State AG+344d

Vermont State AG+344d · this page

South Carolina State AG+402d

Montana State AG+557d

Pattern: first filing Jan 1 (IL), last Jul 11 (MT) — a 557-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ago.vermont.gov/document/2023-12-11-healix-infusion-therapy-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 11, 2023
Raw hash: 035d98284821e7acb8f57f69fbea8cd6c7bfb17cc858a1fe0988c628f8803d81

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityHealix Infusion Therapy, LLC

Victim entityHealix Infusion Therapy, LLC

Incidentdiscovered Sep 12, 2023

Stated responseRetained data privacy counsel and forensic specialists

ComplianceVT AG >45 bday

Extraction provenanceno artifact recorded

Source provenanceago.vermont.gov