HackingHealthcareTechnologyHealthcareStolen CredentialsData ExfiltratedTargetedPHIHealth (basic)PIIIdentity (basic)Government IDHighContained

SAV-RX

bd_a711b87c3aaa61fb · schema v1 · pii pii-v1

Severity

High

Discovered

Oct 8, 2023

Filed

May 24, 2024

To disclose

33 weeks

Affected

1,044state residents only

Linked

7 filings

Confidence

66%

Full breach record for SAV-RX →

A&A Services d/b/a Sav-Rx notified individuals of a data breach where an unauthorized third party accessed non-clinical systems containing PHI and employee PII. Access occurred around Oct 3, 2023; detected Oct 8, 2023. Forensic review confirmed on April 30, 2024. Law enforcement notified. Credit monitoring offered.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 5 days

discovery → filing · 33 weeks / 229 days

Oct 3, 2023

Begins

Oct 8, 2023

Discovered

May 24, 2024

Filed

vs. sector median

+22 wks slower

This filing is one of 7 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

Massachusetts State AGbd_182a0aeca74b988d2024-05-24Verified
Maine State AGbd_3dc61801e1d2468b2024-05-24Candidate
Vermont State AGbd_6eca727782b228442024-05-24Verified
California State AGbd_814ec92dc4fd6b822024-05-24Verified

Show 2 more filings ↓up to 23d gap

Delaware State AGbd_e27bf8cc5118b8fa2024-05-24Verified
Illinois State AGbd_be1e61050e8c84be2024-05-01 · +23dVerified

Name: A&A Services
norm: a&a services
Domain: api.savrx.com

Name: SAV-RX
norm: sav rx
Domain: api.savrx.com
Also named: A&A Servicesdba oflegal entity
Sav-Rxdba oftrade name
Industry: HealthcarellmTechnologyllm

Discovered: Oct 8, 2023
Breach occurred: Oct 3, 2023
Undetected for: 5 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 1,044state-resident count only
Data types: PHIHealth (basic)PIIIdentity (basic)Government ID
Data elements: Medical information
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: External
Regulator citations: promptly notified law enforcement authorities
Initial access: valid_credentials

During the incident: Took immediate action to investigate
Engaged third-party cybersecurity experts
Worked in conjunction with outside cybersecurity experts to contain the incident
Confirmed any data acquired from our IT System was destroyed and not further disseminated
Promptly notified law enforcement authorities
Changes made: Taken a number of steps to enhance our security protocols and controls, technology, and training
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 33 weeks(229 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 7 states

View merged incident ↗

Illinois State AGMay 1 · first

Massachusetts State AG+23d

Maine State AG+23d

Vermont State AG+23d

California State AG+23d

Delaware State AG+23d

Montana State AG+23d · this page

Pattern: first filing May 1 (IL), last May 24 (MT) — a 23-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-notification-letter-1431.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 24, 2024
Raw hash: 2be9fe26bd2e8c29324a373860f1190139290190c0e58ac7609357d5a82921c0

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityA&A Services

Victim entitySAV-RX

Incidentdiscovered Oct 8, 2023

Stated responseTook immediate action to investigate

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov