HackingHealthcareProfessional ServicesHealthcareStolen CredentialsData ExfiltratedCustomer Data InvolvedDelayed DiscoveryGovernment IDIdentity (basic)Financial accountHealth (basic)PHIHighContained

The Phia Group, LLC

bd_ab77d3136d2466cd · schema v1 · pii pii-v1

Severity

High

Discovered

Jul 9, 2024

Filed

Jan 30, 2026

To disclose

19 months

Affected

28,692state residents only

Linked

11 filings

Confidence

70%

Full breach record for The Phia Group, LLC →3 incidents on file

Supplemental Washington AG notice for The Phia Group regarding unauthorized access to data between July 8-9, 2024. Discovered July 9, 2024. Affected 28,692 Washington residents. Data included SSN, driver's license, financial accounts, DOB, and PHI. Notifications mailed Jan-Apr 2026. Forensic investigation engaged; law enforcement notified.

J jump to incidentP pin to compareR raw source

Washington clock✗ WA AG >90d19 months discovery → filing

Incident timeline

undetected · 1 days

discovery → filing · 19 months / 570 days

Jul 8, 2024

Begins

Jul 9, 2024

Discovered

Jan 30, 2026

Filed

vs. sector median

+72 wks slower

This filing is one of 11 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

California State AGbd_466553d842bc56d42026-01-30Candidate
New Hampshire State AGbd_db0c653aaa12ad942026-01-30Verified
Illinois State AGbd_271a07a19c0a459a2026-02-01 · +2dVerified
Nebraska State AGbd_a840e2225354e4512026-01-28 · +2dVerified

Show 6 more filings ↓up to 112d gap

Oregon State AGbd_3ca0825b760c7fe42026-02-07 · +8dVerified by operator
Nebraska State AGbd_7621a09039c596902026-04-23 · +83dVerified
New Hampshire State AGbd_53856ef162652bd82026-05-14 · +104dVerified
California State AGbd_f8a3f4c0b2d6866d2026-05-15 · +105dVerified
South Carolina State AGbd_c206b062995998d42026-05-20 · +110dVerified
Texas State AGbd_71f0f697bddeea282026-05-22 · +112dVerified by operator

Name: Constangy, Brooks, Smith & Prophete, LLP
norm: constangy brooks smith prophete

Name: The Phia Group, LLC
norm: the phia
Industry: HealthcarellmProfessional Servicesllm

Discovered: Jul 9, 2024
Breach occurred: Jul 8, 2024 – Jul 9, 2024
Undetected for: 1 dayoccurrence → discovery
Materiality determined: —
Notification sent: Jan 28, 2026
Affected individuals: 28,692state-resident count only
Data types: Government IDIdentity (basic)Financial accountHealth (basic)PHI
Data elements: NameSocial Security numberDriver's licence numberDate of birthHealth insurance IDMedical information
WA-stated cause: Unauthorized Access
WA-stated duration: lifecycle 1-99dexposure 1-99d
WA-stated discovery: Found while ongoing
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified state regulatory authorities initially when state reporting laws were triggered
Initial access: valid_credentials

During the incident: Engaged digital forensic specialists to conduct an investigation
Took steps to secure the environment
Began working to restore impacted systems
Established a toll-free call center through Kroll
Notified potentially affected individuals
Reported the incident to law enforcement
Changes made: Implemented additional measures to enhance the security of the network environment
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 19 months(570 days from discovery to filing)
Compliance flags: WA AG >90d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 8 states

View merged incident ↗

Nebraska State AGJan 28 · first

California State AG+2d

New Hampshire State AG+2d

Washington State AG+2d · this page

Illinois State AG+4d

Oregon State AG+10d

Nebraska State AG+85d

New Hampshire State AG+106d

California State AG+107d

South Carolina State AG+112d

Texas State AG+114d

Pattern: first filing Jan 28 (NE), last May 22 (TX) — a 114-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA36404.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 30, 2026
Raw hash: 427691732257eaec6b7ba9e25c84b9812e1094eb7b7873c18e2b26abcec29826

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entityConstangy, Brooks, Smith & Prophete, LLP

Victim entityThe Phia Group, LLC

Incidentdiscovered Jul 9, 2024

Stated responseEngaged digital forensic specialists to conduct an investigation

ComplianceWA AG >90d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com