DisclosureLens
MICHIGANHackingHealthcareHealthcareBusiness Associate (HIPAA)Customer Data InvolvedHealth (basic)Identity (basic)High

WARNER NORCROSS & JUDD LLP

bd_ae40e08f1e80359d · schema v1 · pii pii-v1

Severity

High

Discovered

—

Filed

Aug 24, 2022

To disclose

—

Affected

255,160

Linked

16 records

Confidence

50%
Full breach record for WARNER NORCROSS & JUDD LLP →

The business associate (BA), Warner Norcross and Judd, reported that it experienced a cyber-attack affecting the protected health information (PHI) of 255,160 individuals. The PHI involved included names, diagnoses, lab results, medications, and other treatment information. The BA notified HHS, the affected individuals, the media, and provided substitute notice. In response to the breach, the BA provided complimentary credit monitoring services and implemented additional administrative, technical, and security safeguards to better protect PHI.

Leak gap clock✗ Leak >180d
⚠ no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.
⚠ No discovery dateThe OCR public portal omits the discovery date, so the 60-day notification clock cannot be evaluated from this source — only that the filing was submitted.

Incident timeline — partial

? — ?

Breach window unknown

Aug 24, 2022

Filed

No interval is drawn: no breach start or discovery date is on record for this filing.

This filing is one of 16 records about the same incident.View merged incident
A leak claim by lockbit2 about this victim was first seen 306 days before this filing.View originating leak claim

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

Show 6 more filings ↓up to 44d gap

Showing first 10 of 15 linked disclosures.

Filing propagation · 11 filings · 7 states

View merged incident ↗
Maine State AGJul 11 · first
Washington State AG+35d
Oregon State AG+35d
South Carolina State AG+36d
Montana State AG+36d
California State AG+37d
Maine State AG+37d
HHS OCR+44d · this page
California State AG+45d
Washington State AG+46d
Oregon State AG+46d

Pattern: first filing Jul 11 (ME), last Aug 26 (OR) — a 46-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Cascade drawn from the first 10 linked disclosures of 15 — the full spread may be wider.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.