HackingHealthcareProfessional ServicesHealthcareVulnerability ExploitZero-DaySupply Chain (3P Vendor)Customer Data InvolvedData ExfiltratedPHIIdentity (basic)Government IDHealth (basic)Financial accountMediumContained

CHSPSC, LLC

bd_bf411ffed68cd2ce · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 30, 2023

Filed

Apr 17, 2023

To disclose

11 weeks

Affected

Not disclosed

Linked

8 filings

Confidence

64%

Full breach record for CHSPSC, LLC →7 incidents on file

CHSPSC, LLC notified California residents of a security incident involving its vendor, Fortra, LLC. An unauthorized party exploited a previously unknown vulnerability in Fortra's GoAnywhere file transfer platform between January 28 and January 30, 2023. The breach exposed personal information of patients, including names, addresses, Social Security numbers, and medical diagnoses. Fortra took systems offline on January 31, 2023. CHSPSC is offering 24 months of credit monitoring.

J jump to incidentP pin to compareR raw source

California clockDiscovered Jan 30, 2023 → Notified Mar 24, 202352d ✓ CA 60-day OK11 weeks discovery → filing

Incident timeline

undetected · 3 days

discovery → filing · 11 weeks / 76 days

Jan 28, 2023

Begins

Jan 30, 2023

Discovered

Apr 17, 2023

Filed

vs. sector median

1 wks faster

This filing is one of 8 about the same incident.View merged incident

Part of FORTRA, LLC supply-chain incident (2023) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (7) · sorted by filing gap

Oregon State AGbd_05ff925166a4537f2023-04-17Verified
Maine State AGbd_fefafc85063dc9bb2023-04-17Verified
Montana State AGbd_8d82685405a418fc2023-03-08 · +40dVerified
Maine State AGbd_e8298cc5c3b2011e2023-03-08 · +40dVerified

Show 3 more filings ↓up to 41d gap

California State AGbd_0d9ab92e55f3d8a02023-03-07 · +41dCandidate
Oregon State AGbd_2b73da2633a307ff2023-03-07 · +41dVerified
Washington State AGbd_ee40a8445255d0632023-03-07 · +41dVerified

Name: CHSPSC, LLC
norm: chspsc

Name: CHSPSC, LLC
norm: chspsc
Industry: HealthcarellmProfessional Servicesllm

Discovered: Jan 30, 2023
Breach occurred: Jan 28, 2023 – Jan 30, 2023
Undetected for: 3 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 24, 2023
Affected individuals: Not disclosed
Data types: PHIIdentity (basic)Government IDHealth (basic)Financial account
Data elements: Social Security numberDate of birthMedical information
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1195 Supply Chain Compromise
Threat actor: External
Regulator citations: Notified FBINotified CISA
Third party: via Fortra, LLC
Initial access: exploit_public_facing

During the incident: Took impacted systems offline on January 31, 2023
Began its own investigation of potential impact
In contact with law enforcement, including the Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA)
Supporting law enforcement’s investigation
Changes made: Implemented additional security measures, including immediate steps to implement measures to harden the security of CHSPSC’s use of the GoAnywhere platform
Making available ID restoration and credit monitoring services for 24 months, at no cost, through Experian
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 11 weeks(77 days from discovery to filing)
Compliance flags: CA 60-day OK · 52d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Jan 30, 2023
→ Notified: Mar 24, 2023
52d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Jan 30, 2023 → Notified: Mar 24, 2023	52d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 5 states

View merged incident ↗

California State AGMar 7 · first

Oregon State AGMar 7 · first

Washington State AGMar 7 · first

Montana State AG+1d

Maine State AG+1d

Oregon State AG+41d

Maine State AG+41d

California State AG+41d · this page

Pattern: first filing Mar 7 (CA), last Apr 17 (CA) — a 41-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-565652
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 17, 2023
Raw hash: 1b3013b415d691aacbd5328025a2b54aa9b22f493c163a97bb3efc5d093a1c19

Linked disclosures

Regulatory filings (7) · sorted by filing gap

Reporting entityCHSPSC, LLC

Victim entityCHSPSC, LLC

Incidentdiscovered Jan 30, 2023

Stated responseTook impacted systems offline on January 31, 2023

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov