HackingHealthcareHealthcareSupply Chain (3P Vendor)Customer Data InvolvedPHIHealth (basic)Identity (basic)LowContained

Kaniksu Community Health

bd_9ca06938a39c1617 · schema v1 · pii pii-v2

Severity

Low

Discovered

Jun 26, 2026

Filed

Sep 1, 2026

To disclose

10 weeks

Affected

Not disclosed

Linked

3 filings

Confidence

66%

Full breach record for Kaniksu Community Health →2 incidents on file

Kaniksu Community Health notified patients of a data incident involving its third-party healthcare data management provider, Aesto, LLC. The incident occurred on December 18, 2025, and was discovered on June 26, 2026, when Aesto informed Kaniksu. Patient data, potentially including PHI and PII, may have been accessed. Kaniksu engaged a cybersecurity firm and is offering identity monitoring via Kroll.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 190 days

discovery → filing · 10 weeks / 67 days

Dec 18, 2025

Begins

Jun 26, 2026

Discovered

Sep 1, 2026

Filed

vs. sector median

1 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_8b1fcdd22fe5d2de2026-09-01Verified
Vermont State AGbd_c0324af55cfdb1a62026-09-05 · +4dVerified

Name: Kaniksu Community Health
norm: kaniksu community health

Name: Kaniksu Community Health
norm: kaniksu community health
Industry: Healthcarellm

Discovered: Jun 26, 2026
Breach occurred: Dec 18, 2025
Undetected for: 190 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: PHIHealth (basic)Identity (basic)
Attack vector: Third-Party / Supply Chain
Threat actor: External
Third party: via Aesto, LLC
Initial access: supply_chain

During the incident: Launched an investigation
Engaged a national cybersecurity firm to assist in assessing the scope of the incident
Secured the services of Kroll to provide identity monitoring at no cost
Changes made: Evaluating opportunities to further secure our systems
Ensuring that our service providers do the same to prevent a similar event from occurring again in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 10 weeks(67 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Massachusetts State AGSep 1 · first

California State AGSep 1 · first · this page

Vermont State AG+4d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-629145
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 1, 2026
Raw hash: 0bfb2f8bcdeb8b36c8319328d306f2809aa04985fd6f224c5c83425d7d24c37b

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityKaniksu Community Health

Victim entityKaniksu Community Health

Incidentdiscovered Jun 26, 2026

Stated responseLaunched an investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov