HackingHealthcareTechnologyHealthcareVulnerability ExploitStolen CredentialsZero-DaySupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedEmployee Data InvolvedGovernment IDIdentity (basic)Health (basic)PHIMediumActive

BIOMERIEUX, INC.

bd_c7d7b2b9ad302a8a · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 1, 2023

Filed

Jul 14, 2023

To disclose

6 weeks

Affected

14state residents only

Linked

4 filings

Confidence

66%

Full breach record for BIOMERIEUX, INC. →

bioMérieux, Inc. notified NH AG of a data breach involving its vendor, Vitality Group, LLC. A zero-day vulnerability in MOVEit Transfer exploited on May 30, 2023, allowed unauthorized access to personal data of 14 NH residents. Data included SSNs, DOBs, and health claims info. Notification sent July 6, 2023.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 2 days

discovery → filing · 6 weeks / 43 days

May 30, 2023

Begins

Jun 1, 2023

Discovered

Jul 14, 2023

Filed

vs. sector median

5 wks faster

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Maine State AGbd_0f759e4628b860262023-07-12 · +2dVerified
Indiana State AGbd_05debf3564736ed42023-07-06 · +8dVerified
Massachusetts State AGbd_ef7da279f4ef9c7c2023-06-30 · +14dCandidate

Name: TAFT STETTINIUS & HOLLISTER LLP
norm: taft stettinius hollister

Name: BIOMERIEUX, INC.
norm: biomerieux
Industry: HealthcarellmTechnologyllm

Discovered: Jun 1, 2023
Breach occurred: May 30, 2023 – May 30, 2023
Undetected for: 2 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 6, 2023
Affected individuals: 14state-resident count only
Data types: Government IDIdentity (basic)Health (basic)PHI
Data elements: Social Security numberDate of birth
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid AccountsT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Office of the Attorney General
Initial access: exploit_public_facing

During the incident: Vitality disconnected the MOVEit software server
Vitality temporarily disabled access to MOVEIt
Vitality began forensics investigations
Vitality applied all available patches provided by MOVEit
Vitality implemented a password reset on every account that accesses the server
BioMérieux stopped sharing team member personal data with Vitality
BioMérieux issued an advisory to potentially impacted individuals
Changes made: Vitality implemented additional security measures
Vitality is continuing to monitor the situation carefully
Vitality is providing all potentially impacted individuals with twenty-four months of credit monitoring and identity theft insurance services administered through Experian
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(43 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Massachusetts State AGJun 30 · first

Indiana State AG+6d

Maine State AG+12d

New Hampshire State AG+14d · this page

Pattern: first filing Jun 30 (MA), last Jul 14 (NH) — a 14-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/biomerieux-20230714.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 14, 2023
Raw hash: 1f983905b413dd0c8f069fe6519e7b42ee02a4f353120aff4130ffae1d47b0b5

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityTAFT STETTINIUS & HOLLISTER LLP

Victim entityBIOMERIEUX, INC.

Incidentdiscovered Jun 1, 2023

Stated responseVitality disconnected the MOVEit software server

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov