Social EngineeringHealthcareHealthcarePhishingStolen CredentialsTargetedCustomer Data InvolvedPHIHealth (basic)Identity (basic)LowContained

INTERLINK Health Services, Inc

bd_c70d2e82a8fd714e · schema v1 · pii pii-v1

Severity

Low

Discovered

Jun 17, 2024

Filed

Feb 20, 2025

To disclose

35 weeks

Affected

Not disclosed

Linked

5 filings

Confidence

65%

Full breach record for INTERLINK Health Services, Inc →

INTERLINK Health Services, Inc. notified Maryland AG of a phishing incident where an unauthorized actor accessed an employee email account from June 15-17, 2024. The actor searched for financial terms but likely viewed emails containing PHI, including diagnosis, treatment, and billing info. No networks were compromised. INTERLINK secured the account, enhanced safeguards, provided employee training, and offered one year of Experian credit monitoring.

J jump to incidentP pin to compareR raw source

Maryland clock✗ MD AG >90d35 weeks discovery → filing

Incident timeline

undetected · 2 days

discovery → filing · 35 weeks / 248 days

Jun 15, 2024

Begins

Jun 17, 2024

Discovered

Feb 20, 2025

Filed

vs. sector median

+23 wks slower

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Montana State AGbd_0f811efd848b21422025-02-20Candidate
Massachusetts State AGbd_2dd26e35160844d52025-02-20Verified
Oregon State AGbd_50ed8048abdfd6a92025-02-20Verified
Indiana State AGbd_876d5fdbb05b9f8c2025-01-07 · +44dVerified

Name: INTERLINK Health Services, Inc
norm: interlink health
Domain: interlinkhealth.com

Name: INTERLINK Health Services, Inc
norm: interlink health
Domain: interlinkhealth.com
Industry: Healthcarellm

Discovered: Jun 17, 2024
Breach occurred: Jun 15, 2024 – Jun 17, 2024
Undetected for: 2 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 19, 2025
Affected individuals: Not disclosed
Data types: PHIHealth (basic)Identity (basic)
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: External
Initial access: phishing_link

During the incident: Launched an investigation with the assistance of third-party specialists
Secured the impacted email account
Provided free access to Experian credit monitoring services for one year
Changes made: Provided more training and testing for employees
Changed/updated policies
Limiting email accumulation for individuals
Implementing mobile devise management and limits to what IP addresses can connect to the Windows 365 accounts
Enhanced network safeguards
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 35 weeks(248 days from discovery to filing)
Compliance flags: MD AG >90d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Indiana State AGJan 7 · first

Montana State AG+44d

Massachusetts State AG+44d

Oregon State AG+44d

Maryland State AG+44d · this page

Pattern: first filing Jan 7 (IN), last Feb 20 (MD) — a 44-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.maryland.gov/resources-info/SBN%20Documents/2025/ITU-376387.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 20, 2025
Raw hash: 28534be468929b46aaf1840211140a20697f76c35114a68a33651d4c4f5af81e

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityINTERLINK Health Services, Inc

Victim entityINTERLINK Health Services, Inc

Incidentdiscovered Jun 17, 2024

Stated responseLaunched an investigation with the assistance of third-party specialists

ComplianceMD AG >90d

Extraction provenanceno artifact recorded

Source provenanceoag.maryland.gov