HackingTechnologyHealthcareInformationStolen CredentialsData ExfiltratedCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDHealth (basic)Financial accountMediumContained

Connexin Software, Inc.

bd_d5db1475a509da85 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 26, 2022

Filed

Nov 28, 2022

To disclose

13 weeks

Affected

Not disclosed

Linked

7 filings

Confidence

66%

Full breach record for Connexin Software, Inc. →2 incidents on file

Connexin Software, Inc. notified the New Hampshire Attorney General of a data breach affecting approximately two New Hampshire residents. On August 26, 2022, Connexin detected a data anomaly and on September 13, 2022, confirmed an unauthorized party accessed offline patient data used for troubleshooting. Data potentially exposed included demographics, SSNs, health insurance info, and medical records. Connexin reset passwords, engaged forensic experts, and notified law enforcement. Affected individuals received 12 months of credit/identity monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 13 weeks / 94 days

Aug 26, 2022

Discovered

Nov 28, 2022

Filed

vs. sector median

5 wks faster

This filing is one of 7 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

Massachusetts State AGbd_ba794324e12990b22022-11-28Verified
California State AGbd_1714e873907ffbd72022-11-14 · +14dVerified
Oregon State AGbd_5b34d1b03ca82c402022-11-14 · +14dVerified
Montana State AGbd_a2703f9eb481b2012022-11-14 · +14dVerified

Show 2 more filings ↓up to 17d gap

South Carolina State AGbd_a4c6d762fac543f52022-11-14 · +14dVerified
HHS OCRbd_fd18f9fae5f5fe0a2022-11-11 · +17dVerified

Name: Alston & Bird LLP
norm: alston bird

Name: Connexin Software, Inc.
norm: connexin software
Industry: TechnologyllmHealthcarellm

Discovered: Aug 26, 2022
Materiality determined: —
Notification sent: Nov 25, 2022
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDHealth (basic)Financial account
Data elements: Social Security numberDate of birthMedical information
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified the Office of the New Hampshire Attorney General
Initial access: valid_credentials

During the incident: Engaged third-party forensic experts to determine the nature and scope of the incident
Reset password of all corporate accounts
Moved all patient data used for data conversion and troubleshooting into an environment with even greater security
Retained a third-party cybersecurity forensic firm to investigate the issue
Working with law enforcement to investigate the incident
Changes made: Enhanced its security and monitoring
Further hardened its systems as appropriate to minimize the risk of any similar incident in the future
Offered free credit monitoring services for 12 months to New Hampshire residents whose Social Security number may have been involved
Arranged to offer child identity monitoring services for a period of one year, at no cost, through Kroll
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 13 weeks(94 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 7 states

View merged incident ↗

HHS OCRNov 11 · first

California State AG+3d

Oregon State AG+3d

Montana State AG+3d

South Carolina State AG+3d

Massachusetts State AG+17d

New Hampshire State AG+17d · this page

Pattern: first filing Nov 11 (PA), last Nov 28 (NH) — a 17-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/connexin-software-20221128.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 28, 2022
Raw hash: 10132fa5dac2915fddee1b7428fb3ea3b14854ad4c75ab4c962a0b075fcb6b66

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityAlston & Bird LLP

Victim entityConnexin Software, Inc.

Incidentdiscovered Aug 26, 2022

Stated responseEngaged third-party forensic experts to determine the nature and scope of the incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov