Social EngineeringHealthcareProfessional ServicesHealthcarePhishingStolen CredentialsTargetedCustomer Data InvolvedIdentity (basic)CredentialsLowContained

Health Care For All

bd_bf792420108b13c4 · schema v1 · pii pii-v1

Severity

Low

Discovered

Mar 12, 2025

Filed

May 9, 2025

To disclose

8 weeks

Affected · nationwide

601 in this filing

Linked

2 filings

Confidence

65%

Full breach record for Health Care For All →

Health Care For All notified 60 individuals (including 1 Maine resident) of a breach involving an employee email account. Unauthorized access occurred between Sept 28 and Oct 17, 2024. The incident was discovered on March 12, 2025. Notifications were sent on May 9, 2025. Impacted data included names and potentially other personal identifiers. The organization reset passwords, engaged forensic specialists, and provided 24 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Mar 12, 2025 → Filed with AG May 9, 202558d ⏱ ME AG >30d8 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 165 days

discovery → filing · 8 weeks / 58 days

Sep 28, 2024

Begins

Mar 12, 2025

Discovered

May 9, 2025

Filed

vs. sector median

4 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_6fd531acf0650a1e2025-05-09Verified

Name: Cipriani & Werner
norm: cipriani werner
Domain: c-wlaw.com

Name: Health Care For All
norm: health care for all
Domain: hcfama.org
Industry: HealthcarellmProfessional Servicesllm

Discovered: Mar 12, 2025
Breach occurred: Sep 28, 2024 – Oct 17, 2024
Undetected for: 165 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 9, 2025
Affected individuals: 60state + nationwide
Data types: Identity (basic)Credentials
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid Accounts
Threat actor: External
Regulator citations: Filed notification with Maine Attorney General
Initial access: phishing_link

During the incident: Performed a password reset
Engaged third-party specialists to assist in an investigation
Conducted a thorough review of the account
Changes made: Implemented additional technical safeguards
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(58 days from discovery to filing)
Compliance flags: ME AG >30d · 58d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Mar 12, 2025
→ Filed with AG: May 9, 2025
58d 30 days (soft) ME AG >30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Mar 12, 2025 → Filed with AG: May 9, 2025	58d	30 days (soft)	ME AG >30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Massachusetts State AGMay 9 · first

Maine State AGMay 9 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/97c0487e-2f51-49b8-97aa-bc8a1e33b6fa.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 9, 2025
Raw hash: 109d1d557a3859b9986f45089bb5d6a74e6cad8278b7fb0f5c00676ed85cd973

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityCipriani & Werner

Victim entityHealth Care For All

Incidentdiscovered Mar 12, 2025

Stated responsePerformed a password reset

ComplianceME AG >30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov