HackingTechnologyHealthcareInformationStolen CredentialsData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDHealth (basic)Financial accountHighContained

Connexin Software, Inc.

bd_a2703f9eb481b201 · schema v1 · pii pii-v1

Severity

High

Discovered

Aug 26, 2022

Filed

Nov 14, 2022

To disclose

11 weeks

Affected

17,199state residents only

Linked

7 filings

Confidence

67%

Full breach record for Connexin Software, Inc. →2 incidents on file

Connexin Software, Inc. notified Montana residents of a data breach detected on August 26, 2022. An unauthorized party accessed an offline set of patient data used for troubleshooting, removing some data. Affected information included demographics, SSNs, health insurance details, medical records, and billing info. Connexin engaged forensic experts, reset passwords, and offered one year of Kroll identity monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 11 weeks / 80 days

Aug 26, 2022

Discovered

Nov 14, 2022

Filed

vs. sector median

7 wks faster

This filing is one of 7 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

California State AGbd_1714e873907ffbd72022-11-14Verified
Oregon State AGbd_5b34d1b03ca82c402022-11-14Verified
South Carolina State AGbd_a4c6d762fac543f52022-11-14Verified
HHS OCRbd_fd18f9fae5f5fe0a2022-11-11 · +3dVerified

Show 2 more filings ↓up to 14d gap

Massachusetts State AGbd_ba794324e12990b22022-11-28 · +14dVerified
New Hampshire State AGbd_d5db1475a509da852022-11-28 · +14dVerified

Name: Connexin Software, Inc.
norm: connexin software

Name: Connexin Software, Inc.
norm: connexin software
Industry: TechnologyllmHealthcarellm

Discovered: Aug 26, 2022
Materiality determined: —
Notification sent: —
Affected individuals: 17,199state-resident count only
Data types: Identity (basic)Government IDHealth (basic)Financial account
Data elements: Social Security numberDate of birthMedical information
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: working with law enforcement to investigate the incident
Initial access: valid_credentials

During the incident: Launched an investigation
Engaged third-party forensic experts
Password reset of all corporate accounts
Moving all patient data used for data conversion and troubleshooting into an environment with even greater security
Retained a third-party cybersecurity forensic firm to investigate the issue
Working with law enforcement to investigate the incident
Enhanced its security and monitoring
Hardened its systems
Arranged to offer your child identity monitoring services for a period of one year, at no cost to you, through Kroll
Changes made: Enhanced its security and monitoring
Hardened its systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 11 weeks(80 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 7 states

View merged incident ↗

HHS OCRNov 11 · first

California State AG+3d

Oregon State AG+3d

South Carolina State AG+3d

Montana State AG+3d · this page

Massachusetts State AG+17d

New Hampshire State AG+17d

Pattern: first filing Nov 11 (PA), last Nov 28 (NH) — a 17-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-Notification-Letter-712.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 14, 2022
Raw hash: 8f61e59e88f503f5093be1d7ae94cb21c2d57eb00f1907678b5705f6b954ee19

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityConnexin Software, Inc.

Victim entityConnexin Software, Inc.

Incidentdiscovered Aug 26, 2022

Stated responseLaunched an investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov