HackingHealthcareHealthcareSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)Government IDHighResolved

Brightline

bd_b69375073a6e96d4 · schema v1 · pii pii-v1

Severity

High

Discovered

Feb 6, 2023

Filed

May 10, 2023

To disclose

13 weeks

Affected · nationwide

28,9759 in this filing

Linked

26 records

Confidence

50%

Full breach record for Brightline →

Brightline, Inc., a healthcare organization, reported a data breach affecting 9 Maine residents. The breach, which occurred on January 30, 2023, and was discovered on February 6, 2023, was attributed to a vendor incident. The compromised information includes names and Social Security numbers. In response, Brightline is offering 24 months of complimentary credit monitoring services through TransUnion.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Feb 6, 2023 → Filed with AG May 10, 202393d ⏱ ME AG >30d13 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 7 days

discovery → filing · 13 weeks / 93 days

Jan 30, 2023

Begins

Feb 6, 2023

Discovered

May 10, 2023

Filed

vs. sector median

+4 wks slower

This filing is one of 26 records about the same incident.View merged incident

Part of FORTRA, LLC supply-chain incident (2023) — a supply-chain cascade affecting multiple organizations.View cascade →

A leak claim by cl0p about this victim was first seen 55 days before this filing.View originating leak claim

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

California State AGbd_0868c3f9cf5006022023-05-10Verified
HHS OCRbd_4c63e3855981b1222023-05-10Verified
California State AGbd_d59ed55c5ee4770a2023-05-12 · +2dVerified
California State AGbd_bf99fc2a4df4a34d2023-05-17 · +7dVerified

Show 6 more filings ↓up to 23d gap

Oregon State AGbd_163db05cc4cb89582023-05-02 · +8dVerified by operator
HHS OCRbd_f567c60a6fd57cc42023-05-26 · +16dVerified
California State AGbd_a1b16fb406ed3ce92023-04-21 · +19dVerified
HHS OCRbd_a0176e4142b0a3702023-04-20 · +20dVerified
Vermont State AGbd_5ea7d3fbb2a5464a2023-04-19 · +21dVerified
New Hampshire State AGbd_ab681e087aaa2ef42023-04-17 · +23dVerified

Showing first 10 of 25 linked disclosures.

Name: Brightline Apartments LLC
norm: brightline apartments

Name: Brightline
norm: brightline
Domain: hellobrightline.com
Industry: Healthcarellm

Discovered: Feb 6, 2023
Breach occurred: Jan 30, 2023
Undetected for: 7 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 7, 2023
Affected individuals: 28,975state + nationwide
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Third-Party / Supply Chain

Changes made: Offered 24 months of complimentary credit monitoring services through TransUnion.
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 13 weeks(93 days from discovery to filing)
Compliance flags: ME AG >30d · 93dLeak >30d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Feb 6, 2023
→ Filed with AG: May 10, 2023
93d 30 days (soft) ME AG >30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Feb 6, 2023 → Filed with AG: May 10, 2023	93d	30 days (soft)	ME AG >30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 5 states

View merged incident ↗

New Hampshire State AGApr 17 · first

Vermont State AG+2d

HHS OCR+3d

California State AG+4d

Oregon State AG+15d

California State AG+23d

HHS OCR+23d

Maine State AG+23d · this page

California State AG+25d

California State AG+30d

HHS OCR+39d

Pattern: first filing Apr 17 (NH), last May 26 (CA) — a 39-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Cascade drawn from the first 10 linked disclosures of 25 — the full spread may be wider.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/73c3b1aa-9062-47c2-93a1-a728df66f8ee.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 10, 2023
Raw hash: a083696b8540f1e8f3d85dd894eb976abb6c28d17202ebd1b833f6d06dedd1ca

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entityBrightline Apartments LLC

Victim entityBrightline

Incidentdiscovered Feb 6, 2023

Stated responseOffered 24 months of complimentary credit monitoring services through TransUnion.

ComplianceME AG >30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov