HackingTechnologyHealthcareInformationVulnerability ExploitCapture Stored DataZero-DaySupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDMediumContained

Realm IDX

bd_b2d6fb1de5ab3c2c · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 5, 2023

Filed

Jul 5, 2023

To disclose

4 weeks

Affected

2state residents only

Linked

4 filings

Confidence

66%

Full breach record for Realm IDX →

REALM IDx, Inc. and Ambry Genetics reported a third-party vendor breach involving Vitality. Vitality, a provider of employee wellness benefits, was impacted by a zero-day vulnerability in Progress Software's MOVEit Transfer application. The incident resulted in the exposure of names and Social Security numbers for 2 New Hampshire residents (former and current employees). Notification letters were mailed on June 30, 2023, offering credit monitoring services.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 6 days

discovery → filing · 4 weeks / 30 days

May 30, 2023

Begins

Jun 5, 2023

Discovered

Jul 5, 2023

Filed

vs. sector median

7 wks faster

This filing is one of 4 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Maine State AGbd_0f356133b7e374c72023-06-30 · +5dCandidate
Indiana State AGbd_ba13b39d41e652b22023-06-30 · +5dVerified
Massachusetts State AGbd_c5bc736aa01e583b2023-06-30 · +5dVerified

Name: Realm IDX
norm: realm idx

Name: Realm IDX
norm: realm idx
Industry: TechnologyllmHealthcarellm

Discovered: Jun 5, 2023
Breach occurred: May 30, 2023
Undetected for: 6 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 30, 2023
Affected individuals: 2state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Filed Legal Notice of Information Security Incident with New Hampshire Attorney General
Third party: via Vitality
Initial access: exploit_public_facing

During the incident: Vitality conducted a robust review of the data in the MOVEit application
Vitality implemented a password reset on every account that accesses the MOVEit server
Vitality implemented additional security measures
Vitality applied all available patches provided by Progress
Vitality followed all recommendations published by Progress
Vitality temporarily disabled access to MOVEit
Vitality began forensics investigations
Vitality restored server from backup to a point in time when the vulnerability was not active
Offering complimentary credit monitoring and fraud protection services
Changes made: Applied all available patches provided by Progress
Implemented a password reset on every account that accesses the MOVEit server
Implemented additional security measures
Restored server from backup to a point in time when the vulnerability was not active
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 4 weeks(30 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Maine State AGJun 30 · first

Indiana State AGJun 30 · first

Massachusetts State AGJun 30 · first

New Hampshire State AG+5d · this page

Pattern: first filing Jun 30 (ME), last Jul 5 (NH) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/realm-idx-20230705.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 5, 2023
Raw hash: 394d56ed4d703e49622db5e6fc5a5b76d9f9a0afb188c77c44c7ded7c434f655

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityRealm IDX

Victim entityRealm IDX

Incidentdiscovered Jun 5, 2023

Stated responseVitality conducted a robust review of the data in the MOVEit application

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov