HackingHealthcareTechnologyHealthcareStolen CredentialsCustomer Data InvolvedData ExfiltratedPIIIdentity (basic)LowContained

Navvis & Company, LLC

bd_c1942c40dd4a3a2a · schema v1 · pii pii-v1

Severity

Low

Discovered

Jul 25, 2023

Filed

Feb 9, 2024

To disclose

28 weeks

Affected

255state residents only

Linked

8 filings

Confidence

66%

Full breach record for Navvis & Company, LLC →5 incidents on file

Navvis & Company, LLC, a provider of health management services, disclosed a data breach affecting 255 New Hampshire residents. Unauthorized access occurred between July 12 and July 25, 2023. Navvis detected suspicious activity on July 25, 2023, and notified law enforcement, HHS, and state regulators. Affected individuals received credit monitoring services.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 13 days

discovery → filing · 28 weeks / 199 days

Jul 12, 2023

Begins

Jul 25, 2023

Discovered

Feb 9, 2024

Filed

vs. sector median

+16 wks slower

This filing is one of 8 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (7) · sorted by filing gap

California State AGbd_a130e687bb61da4c2024-02-09Verified
South Carolina State AGbd_832b7bd8a467c8c62024-02-13 · +4dVerified
Hawaii State AGbd_6aa3eb6d91fa1e7e2024-01-09 · +31dVerified
California State AGbd_f4c28766fb97e6552024-01-09 · +31dVerified

Show 3 more filings ↓up to 42d gap

California State AGbd_495a8622b73384502023-12-29 · +42dVerified
Oregon State AGbd_807126e4c7ec4b162023-12-29 · +42dCandidate
Washington State AGbd_9514dafc4153c0c82023-12-29 · +42dVerified by operator

Name: Navvis & Company, LLC
norm: navvis

Name: Navvis & Company, LLC
norm: navvis
Industry: HealthcarellmTechnologyllm

Discovered: Jul 25, 2023
Breach occurred: Jul 12, 2023 – Jul 25, 2023
Undetected for: 13 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 22, 2023
Affected individuals: 255state-resident count only
Data types: PIIIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: notified federal law enforcement regarding the eventproviding written notice of this incident to relevant state regulators, as necessarynotified the U.S. Department of Health and Human Services pursuant to the Health Insurance Portability and Accountability Act (HIPAA)
Initial access: valid_credentials

During the incident: Moved quickly to investigate and respond to the incident
Assess the security of Navvis systems
Identify affected individuals
Notified federal law enforcement regarding the event
Working to implement additional safeguards and training to its employees
Providing access to credit monitoring services for , through IDX, to individuals whose personal information was affected by this incident, at no cost to these individuals
Providing impacted individuals with guidance on how to better protect against identity theft and fraud
Providing written notice of this incident to relevant state regulators, as necessary
Notified the U.S. Department of Health and Human Services pursuant to the Health Insurance Portability and Accountability Act (HIPAA)
Notified prominent media
Changes made: Reviewing and enhancing our already robust policies and procedures related to data privacy to reduce the likelihood of a similar future event
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 28 weeks(199 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 6 states

View merged incident ↗

California State AGDec 29 · first

Oregon State AGDec 29 · first

Washington State AGDec 29 · first

Hawaii State AG+11d

California State AG+11d

California State AG+42d

New Hampshire State AG+42d · this page

South Carolina State AG+46d

Pattern: first filing Dec 29 (CA), last Feb 13 (SC) — a 46-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/navvis-company-20240209.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 9, 2024
Raw hash: b2b2461d00aa18e20b877e7f77d99c73fde2c3e9a75d68120be0e6b54489a718

Linked disclosures

Regulatory filings (7) · sorted by filing gap

Reporting entityNavvis & Company, LLC

Victim entityNavvis & Company, LLC

Incidentdiscovered Jul 25, 2023

Stated responseMoved quickly to investigate and respond to the incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov