HackingHealthcareHealthcareStolen CredentialsCustomer Data InvolvedEmployee Data InvolvedGovernment IDFinancial accountPHIHealth (basic)Identity (basic)HighResolved

Aveanna Healthcare LLC

bd_9995f453fd70a8fa · schema v1 · pii pii-v1

Severity

High

Discovered

Aug 24, 2019

Filed

Feb 14, 2020

To disclose

25 weeks

Affected

5,004state residents only

Linked

5 filings

Confidence

66%

Full breach record for Aveanna Healthcare LLC →5 incidents on file

Aveanna Healthcare experienced unauthorized access to employee email accounts between July 9, 2019, and August 24, 2019. The incident was discovered on August 24, 2019. Personal information, including SSNs, driver's licenses, financial account info, and medical/health insurance data, for 5,004 California residents was potentially exposed. Aveanna engaged forensic specialists, secured accounts, implemented MFA, and offered 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

California clockDiscovered Aug 24, 2019 → Notified Feb 14, 2020174d ✗ CA 60-day late25 weeks discovery → filing

Incident timeline

undetected · 46 days

discovery → filing · 25 weeks / 174 days

Jul 9, 2019

Begins

Aug 24, 2019

Discovered

Feb 14, 2020

Filed

vs. sector median

+12 wks slower

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

HHS OCRbd_16f4b4559fe496492020-02-14Candidate
Massachusetts State AGbd_575428465435b8372020-02-14Verified
Washington State AGbd_d63cfe491add01db2020-02-14Verified
Montana State AGbd_dedaafa6f47142182020-02-14Candidate

Name: Aveanna Healthcare LLC
norm: aveanna healthcare
Domain: aveanna.com

Name: Aveanna Healthcare LLC
norm: aveanna healthcare
Domain: aveanna.com
Industry: Healthcarellm

Discovered: Aug 24, 2019
Breach occurred: Jul 9, 2019 – Aug 24, 2019
Undetected for: 46 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 14, 2020
Affected individuals: 5,004state-resident count only
Data types: Government IDFinancial accountPHIHealth (basic)Identity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: External
Regulator citations: Provided notice of this incident to other state and federal regulators

During the incident: Took steps to secure the email accounts
Began working with outside computer forensics specialists to determine the nature and scope of the activity
Performed a comprehensive review of the contents of the impacted email accounts
Changed the credentials for the involved email accounts
Provided notice to potentially affected individuals
Provided complimentary access to twelve (12) months of credit monitoring and identity restoration services through TransUnion
Provided guidance on how to better protect against identity theft and fraud
Provided notice of this incident to other state and federal regulators and the three major credit reporting agencies
Changes made: Implemented additional security measures for employee email accounts and access to company systems including multi-factor authentication
Reviewed company policies and procedures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 25 weeks(174 days from discovery to filing)
Compliance flags: CA 60-day late · 174d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Aug 24, 2019
→ Notified: Feb 14, 2020
174d 60 days (analyst band, pre-2026 discoveries) CA 60-day late

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Aug 24, 2019 → Notified: Feb 14, 2020	174d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

HHS OCRFeb 14 · first

Massachusetts State AGFeb 14 · first

Washington State AGFeb 14 · first

Montana State AGFeb 14 · first

California State AGFeb 14 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-187372
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 14, 2020
Raw hash: f27539cda450f9508a576e2bd9348f4428906b77dc2b153e3d8921da5f06f839

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityAveanna Healthcare LLC

Victim entityAveanna Healthcare LLC

Incidentdiscovered Aug 24, 2019

Stated responseTook steps to secure the email accounts

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov