HackingHealthcareTechnologyHealthcareCustomer Data InvolvedData ExfiltratedPHIIdentity (basic)Health (basic)LowContained

Arbor Associates Inc

bd_b50fb3d4dec6d3c4 · schema v1 · pii pii-v1

Severity

Low

Discovered

Apr 17, 2025

Filed

Aug 8, 2025

To disclose

16 weeks

Affected

Not disclosed

Linked

11 filings

Confidence

64%

Full breach record for Arbor Associates Inc →

Arbor Associates, Inc. disclosed a data security incident where unauthorized access occurred between April 15 and April 17, 2025. The company became aware of unusual network activity on April 17, 2025. Affected data included protected health information (PHI) such as names, contact info, age, sex, date of birth, service dates, CPT/diagnosis codes, medical record numbers, insurance names, and doctor names. This is a supplemental notification. Arbor engaged cybersecurity experts and implemented enhanced security measures.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 2 days

discovery → filing · 16 weeks / 113 days

Apr 15, 2025

Begins

Apr 17, 2025

Discovered

Aug 8, 2025

Filed

vs. sector median

+4 wks slower

This filing is one of 11 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

Montana State AGbd_90472ab9e6074d4a2025-08-08Verified
Texas State AGbd_a75ba824f7da509a2025-08-12 · +4dVerified
Vermont State AGbd_5c23d20e0ad3430d2025-07-17 · +22dVerified
Oregon State AGbd_7e87e5d560735bef2025-07-17 · +22dVerified

Show 6 more filings ↓up to 38d gap

Massachusetts State AGbd_15a5c87af98e6ebd2025-07-03 · +36dVerified
HHS OCRbd_19e14edfcd577e892025-07-03 · +36dVerified
Washington State AGbd_4477dbc38992c4432025-07-03 · +36dVerified
Montana State AGbd_a984f051dd655e2f2025-07-03 · +36dVerified
California State AGbd_d13f3fd45725847a2025-07-03 · +36dVerified
Illinois State AGbd_2139cdce40ed95232025-07-01 · +38dCandidate

Name: Arbor
norm: arbor
Domain: arbor-education.com

Name: Arbor Associates Inc
norm: arbor associates
Domain: arbor-associates.com
Industry: HealthcarellmTechnologyllm

Discovered: Apr 17, 2025
Breach occurred: Apr 15, 2025 – Apr 17, 2025
Undetected for: 2 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 8, 2025
Affected individuals: Not disclosed
Data types: PHIIdentity (basic)Health (basic)
Attack vector: Unknown
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External

During the incident: Took steps to secure our systems and perform an investigation
Engaged independent cybersecurity experts to assist with the process
Undertook a comprehensive review of the potentially affected files
Implemented measures to enhance security and minimize the risk of a similar incident occurring in the future
Changes made: Implemented measures to enhance security and minimize the risk of a similar incident occurring in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 16 weeks(113 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 9 states

View merged incident ↗

Illinois State AGJul 1 · first

Massachusetts State AG+2d

HHS OCR+2d

Washington State AG+2d

Montana State AG+2d

California State AG+2d

Vermont State AG+16d

Oregon State AG+16d

Montana State AG+38d

California State AG+38d · this page

Texas State AG+42d

Pattern: first filing Jul 1 (IL), last Aug 12 (TX) — a 42-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-606902
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 8, 2025
Raw hash: 73b8a1d90cd9197bddbf2063d43cd0e00a383b44d84ce91987c690d21d181699

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entityArbor

Victim entityArbor Associates Inc

Incidentdiscovered Apr 17, 2025

Stated responseTook steps to secure our systems and perform an investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov