Social EngineeringHealthcareTechnologyHealthcarePhishingStolen CredentialsData ExfiltratedCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDFinancial accountHealth (basic)AuthenticationHighResolved

Ciox Health

bd_b3dc1935edf30ecf · schema v1 · pii pii-v1

Severity

High

Discovered

May 9, 2024

Filed

Feb 11, 2025

To disclose

40 weeks

Affected · nationwide

49,45417 in this filing

Linked

6 filings

Confidence

66%

Full breach record for Ciox Health →5 incidents on file

Ciox Health LLC d/b/a Datavant Group reported a phishing incident affecting 49,454 individuals. Unauthorized access occurred May 8-9, 2024, via compromised email accounts. Data exposed included names, SSNs, financial accounts, driver's licenses, and health information. Datavant engaged forensic experts, implemented security safeguards, and offered 24 months of Kroll identity monitoring.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered May 9, 2024 → Filed with AG Feb 11, 2025278d ✗ ME AG >90d40 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 1 days

discovery → filing · 40 weeks / 278 days

May 8, 2024

Begins

May 9, 2024

Discovered

Feb 11, 2025

Filed

vs. sector median

+28 wks slower

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Nebraska State AGbd_5a7f3d35a93b97ca2025-02-11Verified
New Hampshire State AGbd_c8daf6858a2162c92024-12-09 · +64dVerified
Indiana State AGbd_6a23636d969f92102024-12-06 · +67dCandidate
Massachusetts State AGbd_f9476d2f682079122024-12-06 · +67dVerified

Show 1 more filing ↓up to 72d gap

Illinois State AGbd_2ba6233f1ffdc2a02024-12-01 · +72dVerified

Name: McDermott Will & Emery LLP
norm: mcdermott will
Domain: mcdermottlaw.com

Name: Ciox Health
norm: ciox health
Also named: Ciox Health LLCdba oflegal entity
Datavant Groupdba oftrade name
Industry: HealthcarellmTechnologyllm

Discovered: May 9, 2024
Breach occurred: May 8, 2024 – May 9, 2024
Undetected for: 1 dayoccurrence → discovery
Materiality determined: —
Notification sent: Dec 6, 2024
Affected individuals: 49,454state + nationwide
Data types: Identity (basic)Government IDFinancial accountHealth (basic)Authentication
Data elements: Social Security numberMedical information
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Initial access: phishing_link

During the incident: Promptly began investigating this incident with the assistance of a respected forensic security provider
Worked with external cybersecurity experts to resolve the phishing attack
Implemented or updated a variety of technical security safeguards
Regularly trains its employees on phishing awareness
Retained Kroll to provide Minor Identity Monitoring, Fraud Consultation, and Identity Theft Restoration at no cost to you for two years
Changes made: Implemented or updated a variety of technical security safeguards
Regularly trains its employees on phishing awareness
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 40 weeks(278 days from discovery to filing)
Compliance flags: ME AG >90d · 278dME resident >180d · 211d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: May 9, 2024
→ Filed with AG: Feb 11, 2025
278d 90 days ME AG >90d
Maine
Discovered: May 9, 2024
→ Notified: Dec 6, 2024
211d 180 days ME resident >180d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: May 9, 2024 → Filed with AG: Feb 11, 2025	278d	90 days	ME AG >90d
Maine	Discovered: May 9, 2024 → Notified: Dec 6, 2024	211d	180 days	ME resident >180d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Illinois State AGDec 1 · first

Indiana State AG+5d

Massachusetts State AG+5d

New Hampshire State AG+8d

Nebraska State AG+72d

Maine State AG+72d · this page

Pattern: first filing Dec 1 (IL), last Feb 11 (ME) — a 72-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/1722fefd-4dce-4e2b-b62b-bae31991345f.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 11, 2025
Raw hash: 72a1f03d74cb2ac11bb94347c2caf425779626d55e0e6838d8407b3623650f0a

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityMcDermott Will & Emery LLP

Victim entityCiox Health

Incidentdiscovered May 9, 2024

Stated responsePromptly began investigating this incident with the assistance of a respected forensic security provider

ComplianceME AG >90d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov