HackingHealthcareFinancial ServicesHealthcareVulnerability ExploitCapture Stored DataData ExfiltratedCustomer Data InvolvedBusiness Associate (HIPAA)Downstream VictimsPIIIdentity (basic)MediumContained

DELTA DENTAL OF CALIFORNIA

bd_b33482b171701d94 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 1, 2023

Filed

Mar 15, 2024

To disclose

41 weeks

Affected

12,783state residents only

Linked

11 filings

Confidence

65%

Full breach record for DELTA DENTAL OF CALIFORNIA →5 incidents on file

Delta Dental of California filed a supplemental notification with the New Hampshire Attorney General regarding the MOVEit Transfer software data breach. Unauthorized actors exploited a vulnerability to access data between May 27-30, 2023. The incident was discovered on June 1, 2023. The breach affected 12,783 New Hampshire residents, including participants in Delta Dental's fully insured plans and self-funded plans of its clients. Personal information including names was compromised. Delta Dental engaged forensic experts, patched the system, reset passwords, and offered 24 months of credit monitoring via Kroll.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 5 days

discovery → filing · 41 weeks / 288 days

May 27, 2023

Begins

Jun 1, 2023

Discovered

Nov 27, 2023

Scope determined

Mar 15, 2024

Filed

vs. sector median

+29 wks slower

This filing is one of 11 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

Hawaii State AGbd_48ccff9e491e5a462024-03-18 · +3dVerified
Montana State AGbd_999bf44f190153fb2024-02-07 · +37dVerified
Washington State AGbd_f32bc4138c99af892024-02-07 · +37dVerified
Washington State AGbd_2b669447999006a92024-01-30 · +45dVerified

Show 6 more filings ↓up to 92d gap

Maine State AGbd_b0392e182589e9502023-12-29 · +77dVerified by operator
Massachusetts State AGbd_2aecb331d440f93c2023-12-14 · +92dVerified
Oregon State AGbd_2c29103cacdbca1f2023-12-14 · +92dCandidate
Vermont State AGbd_40e8f6904a6f52b92023-12-14 · +92dVerified
Montana State AGbd_54f04c0719e262cf2023-12-14 · +92dVerified
Washington State AGbd_9c3c9a75bc9bb9122023-12-14 · +92dVerified

Name: DELTA DENTAL OF CALIFORNIA
norm: delta dental of california
Domain: deltadentalca.com

Name: DELTA DENTAL OF CALIFORNIA
norm: delta dental of california
Domain: deltadentalca.com
Industry: HealthcarellmFinancial Servicesllm

Discovered: Jun 1, 2023
Breach occurred: May 27, 2023 – May 30, 2023
Undetected for: 5 daysoccurrence → discovery
Materiality determined: Nov 27, 2023
Notification sent: Dec 14, 2023
Affected individuals: 12,783state-resident count only
Data types: PIIIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney GeneralNotified law enforcement
Initial access: exploit_public_facing

During the incident: Stopped access to the MOVEit software
Removed the malicious files
Conducted a thorough analysis of the MOVEit database
Applied the recommended patches from Progress Software Corporation
Reset administrative passwords to the MOVEit system
Enhanced unauthorized access monitoring related to the MOVEit Transfer file access, malicious activity, and ransomware activity
Engaged independent third-party experts in computer forensics, analytics, and data mining
Notified law enforcement
Offered free identity theft protection and fraud restoration services through Kroll
Changes made: Applied the recommended patches from Progress Software Corporation
Reset administrative passwords to the MOVEit system
Enhanced unauthorized access monitoring related to the MOVEit Transfer file access, malicious activity, and ransomware activity
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 41 weeks(288 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 8 states

View merged incident ↗

Massachusetts State AGDec 14 · first

Oregon State AGDec 14 · first

Vermont State AGDec 14 · first

Montana State AGDec 14 · first

Washington State AGDec 14 · first

Maine State AG+15d

Washington State AG+47d

Montana State AG+55d

Washington State AG+55d

New Hampshire State AG+92d · this page

Hawaii State AG+95d

Pattern: first filing Dec 14 (MA), last Mar 18 (HI) — a 95-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/delta-dental-california-20240315.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 15, 2024
Raw hash: d5714d50bd56d07f84c723320b5e7621933f0f6dfbf1e03fb14cf9bbca4f0bc4

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entityDELTA DENTAL OF CALIFORNIA

Victim entityDELTA DENTAL OF CALIFORNIA

Incidentdiscovered Jun 1, 2023

Stated responseStopped access to the MOVEit software

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov