HackingHealthcareHealthcareStolen CredentialsData ExfiltratedCustomer Data InvolvedDelayed DiscoveryFinancial accountHealth (basic)Identity (basic)Government IDPHIHighResolved

Lincare Holdings Inc.

bd_c6e8a20ea78d5a7b · schema v1 · pii pii-v1

Severity

High

Discovered

Sep 26, 2021

Filed

Mar 25, 2022

To disclose

26 weeks

Affected

37,050state residents only

Linked

6 filings

Confidence

69%

Full breach record for Lincare Holdings Inc. →11 incidents on file

Lincare Holdings Inc. reported unauthorized access to its network affecting 37,050 Washington residents. Access occurred Sept 10-29, 2021; discovered Sept 26, 2021. Data included names, health/insurance info, SSNs, and driver's licenses. Lincare engaged forensic experts, reset passwords, and offered credit monitoring.

J jump to incidentP pin to compareR raw source

Washington clock✗ WA AG >90d26 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 16 days

discovery → filing · 26 weeks / 180 days

Sep 10, 2021

Begins

Sep 26, 2021

Discovered

Mar 25, 2022

Filed

vs. sector median

+13 wks slower

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Oregon State AGbd_36323b1248fdb6862022-04-11 · +17dVerified by operator
Massachusetts State AGbd_673a7dd67c1f19fe2022-02-15 · +38dVerified
Montana State AGbd_54f6545e86d1e3972022-02-09 · +44dCandidate
Oregon State AGbd_133c1a54ff8a079f2022-06-06 · +73dVerified by operator

Show 1 more filing ↓up to 73d gap

California State AGbd_5b9e74ab50bbbb512022-06-06 · +73dVerified by operator

Name: Baker, Donelson, Bearman, Caldwell & Berkowitz, A Professional Corporation
norm: baker donelson bearman caldwell berkowitz a

Name: Lincare Holdings Inc.
norm: lincare holdings
Domain: lincare.com
Industry: Healthcarellm

Discovered: Sep 26, 2021
Breach occurred: Sep 10, 2021 – Sep 29, 2021
Undetected for: 16 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 15, 2022
Affected individuals: 37,050state-resident count only
Data types: Identity (basic)Government IDHealth (basic)Financial account
Data elements: NameSocial Security numberFinancial account numberMedical information
WA-stated cause: Unauthorized Access
WA-stated duration: lifecycle 1-99dexposure 1-99d
WA-stated discovery: Found while ongoing
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified Washington State Office of the Attorney GeneralNotified U.S. Department of Health and Human Services
Initial access: valid_credentials

During the incident: Launched an investigation, including working with outside cybersecurity experts
Notified law enforcement of the incident
Promptly reset all user passwords to block any unauthorized access
Offering you complimentary credit monitoring through Kroll
Changes made: Implementing additional technological safeguards on our systems that contain personal information
Upgrading its endpoint monitoring system
Modifying firewall geo-blocking rules to restrict IP addresses that are permitted to access its network
Enhanced vulnerability scans and penetration testing
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 26 weeks(180 days from discovery to filing)
Compliance flags: WA AG >90d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 5 states

View merged incident ↗

Montana State AGFeb 9 · first

Massachusetts State AG+6d

Washington State AG+44d · this page

Oregon State AG+61d

Oregon State AG+117d

California State AG+117d

Pattern: first filing Feb 9 (MT), last Jun 6 (CA) — a 117-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM13355.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 25, 2022
Raw hash: bc13a834c3209bafc6d9b118ef74e9c6af5754b1b70a375673df875baba6271b

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityBaker, Donelson, Bearman, Caldwell & Berkowitz, A Professional Corporation

Victim entityLincare Holdings Inc.

Incidentdiscovered Sep 26, 2021

Stated responseLaunched an investigation, including working with outside cybersecurity experts

ComplianceWA AG >90d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com