HackingHealthcareHealthcareCustomer Data InvolvedIdentity (basic)Government IDHigh

American Pain and Wellness

bd_99376268d74a9f59 · schema v1 · pii pii-v1

Severity

High

Discovered

Jan 24, 2023

Filed

Mar 24, 2023

To disclose

8 weeks

Affected · nationwide

7,4571 in this filing

Linked

3 filings

Confidence

50%

Full breach record for American Pain and Wellness →

American Pain and Wellness, a healthcare organization, experienced an external system breach (hacking) that occurred between November 10, 2022, and November 27, 2022. The breach was discovered on January 24, 2023. The compromised information includes names and Social Security numbers. One Maine resident was affected out of a total of 7,457 individuals. Consumers were notified in writing on March 24, 2023. Identity theft protection services were not offered.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Jan 24, 2023 → Filed with AG Mar 24, 202359d ⏱ ME AG >30d8 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 75 days

discovery → filing · 8 weeks / 59 days

Nov 10, 2022

Begins

Jan 24, 2023

Discovered

Mar 24, 2023

Filed

vs. sector median

4 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

HHS OCRbd_5eaed1213aac42922023-03-24Verified
Montana State AGbd_99fc07486f7979282023-03-24Verified

Name: American Pain and Wellness
norm: american pain and wellness

Name: American Pain and Wellness
norm: american pain and wellness
Industry: Healthcarellm

Discovered: Jan 24, 2023
Breach occurred: Nov 10, 2022 – Nov 27, 2022
Undetected for: 75 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 24, 2023
Affected individuals: 7,457state + nationwide
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Unauthorized Access
Threat actor: External

Time to disclose: 8 weeks(59 days from discovery to filing)
Compliance flags: ME AG >30d · 59d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Jan 24, 2023
→ Filed with AG: Mar 24, 2023
59d 30 days (soft) ME AG >30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Jan 24, 2023 → Filed with AG: Mar 24, 2023	59d	30 days (soft)	ME AG >30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

HHS OCRMar 24 · first

Montana State AGMar 24 · first

Maine State AGMar 24 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/5f0af895-9bce-434f-86f0-20256aa4d93c.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 24, 2023
Raw hash: 8267954c0601ad9754e9e095e2419ca640926b711dfafa138707652376dc4dd6

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityAmerican Pain and Wellness

Victim entityAmerican Pain and Wellness

Incidentdiscovered Jan 24, 2023

ComplianceME AG >30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov