Social EngineeringHealthcareTechnologyHealthcarePhishingData ExfiltratedCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDMinorMediumContained

Ciox Health

bd_c8daf6858a2162c9 · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 9, 2024

Filed

Dec 9, 2024

To disclose

31 weeks

Affected

20state residents only

Linked

6 filings

Confidence

66%

Full breach record for Ciox Health →5 incidents on file

Ciox Health LLC (d/b/a Datavant Group) notified the NH AG of a phishing incident affecting 20 NH residents. Unauthorized access occurred May 8-9, 2024, via a phishing email targeting a single user's mailbox. Data potentially impacted included names, addresses, and Social Security numbers of minors. Datavant engaged forensic investigators, reset credentials, and offered Kroll identity monitoring services. Notifications were sent December 6, 2024.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 1 days

discovery → filing · 31 weeks / 214 days

May 8, 2024

Begins

May 9, 2024

Discovered

Dec 9, 2024

Filed

vs. sector median

+19 wks slower

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Indiana State AGbd_6a23636d969f92102024-12-06 · +3dCandidate
Massachusetts State AGbd_f9476d2f682079122024-12-06 · +3dVerified
Illinois State AGbd_2ba6233f1ffdc2a02024-12-01 · +8dVerified
Nebraska State AGbd_5a7f3d35a93b97ca2025-02-11 · +64dVerified

Show 1 more filing ↓up to 64d gap

Maine State AGbd_b3dc1935edf30ecf2025-02-11 · +64dVerified

Name: Ciox Health
norm: ciox health

Name: Ciox Health
norm: ciox health
Also named: Ciox Health LLCdba oflegal entity
Datavant Groupdba oftrade name
Industry: HealthcarellmTechnologyllm

Discovered: May 9, 2024
Breach occurred: May 8, 2024 – May 9, 2024
Undetected for: 1 dayoccurrence → discovery
Materiality determined: —
Notification sent: Dec 6, 2024
Affected individuals: 20state-resident count only
Data types: Identity (basic)Government IDMinor
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing Link
Threat actor: External
Initial access: phishing_link

During the incident: Began investigating this incident with the assistance of a respected forensic security provider
Reset affected user passwords and security devices
Updated or implemented a variety of technical security safeguards including reconfiguring its email security settings and updating security software rules
Re-trained its workforce and sanctioned some employees
Sent several anti-phishing reminders following the Incident
Offered complimentary credit monitoring and identity protection services through Kroll
Changes made: Reconfiguring its email security settings
Updating security software rules
Re-trained its workforce
Regularly trains its employees on phishing awareness
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 31 weeks(214 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Illinois State AGDec 1 · first

Indiana State AG+5d

Massachusetts State AG+5d

New Hampshire State AG+8d · this page

Nebraska State AG+72d

Maine State AG+72d

Pattern: first filing Dec 1 (IL), last Feb 11 (ME) — a 72-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/ciox-health-datavant-group-20241209.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 9, 2024
Raw hash: ed77db5ea6324ac04e81b6a5082b41e06809809a7709310c98c6c3782af95365

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityCiox Health

Victim entityCiox Health

Incidentdiscovered May 9, 2024

Stated responseBegan investigating this incident with the assistance of a respected forensic security provider

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov