HackingStolen CredentialsSupply Chain (3P Vendor)Customer Data InvolvedIDENTITY_BASICIDENTITY_GOVERNMENTEMPLOYMENTFINANCIAL_ACCOUNTMediumContained
HEALTHEQUITY, INC.
bd_af6fccca3bd7dd5a · schema v1 · pii pii-v1
Full breach record for HEALTHEQUITY, INC. →HealthEquity, Inc. reported unauthorized access to personal information via a compromised third-party vendor account. The incident was discovered on March 25, 2024, with the breach occurring on March 9, 2024. Affected data included names, addresses, SSNs, and payment card info. HealthEquity engaged forensic experts, disabled compromised accounts, and offered two years of credit monitoring.
California clockDiscovered Mar 25, 2024 → Notified Jun 26, 202493d ✗ CA 60-day late18 weeks discovery → filing
This filing is one of 4 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (3) · sorted by filing gap
- bd_78b071a1c9f6bb51Vermont State AGfiled 2024-07-26Verified
- bd_5de1919bf0e7e946Indiana State AGfiled 2024-07-29(3d gap)Verified
- bd_c6e8a0e9ea2fbb67HHS OCRfiled 2024-08-09(14d gap)Verified
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-589401
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jul 26, 2024
- Raw hash
- 942674422ec8db5d7f5364c0dceed4f9c4249cca0f105c128375cc044006294f
Reporting entity
- Name
- HEALTHEQUITY, INC.norm: healthequity
- Domain
- healthequity.com
Victim entity
- Name
- HEALTHEQUITY, INC.norm: healthequity
- Domain
- healthequity.com
Incident
- Discovered
- Mar 25, 2024
- Materiality determined
- —
- Notification sent
- Jun 26, 2024
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENTEMPLOYMENTFINANCIAL_ACCOUNT
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1078 Valid Accounts
- Threat actor
- External
- Initial access
- supply_chain
Compliance
- Time to disclose
- 18 weeks(123 days from discovery to filing)
- Compliance flags
- CA 60-day late · 93dLeak >180d
- Discovery-date grounding
- letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Mar 25, 2024→ Notified: Jun 26, 202493d 60 days (analyst band, pre-2026 discoveries) CA 60-day late
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.