HackingHealthcareHealthcareStolen CredentialsTargetedIdentity (basic)Government IDFinancial accountHighResolved

Aveanna Healthcare LLC

bd_d63cfe491add01db · schema v1 · pii pii-v1

Severity

High

Discovered

Aug 24, 2019

Filed

Feb 14, 2020

To disclose

25 weeks

Affected

2,444state residents only

Linked

5 filings

Confidence

71%

Full breach record for Aveanna Healthcare LLC →5 incidents on file

Aveanna Healthcare reported a cybersecurity incident affecting 2,444 Washington residents. Unauthorized access to employee email accounts occurred between July 9, 2019, and August 24, 2019. Compromised data included SSNs, driver's licenses, and financial account numbers. Aveanna engaged forensic specialists, reset credentials, implemented MFA, and offered 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 46 days

discovery → filing · 25 weeks / 174 days

Jul 9, 2019

Begins

Aug 24, 2019

Discovered

Feb 14, 2020

Filed

vs. sector median

+12 wks slower

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

HHS OCRbd_16f4b4559fe496492020-02-14Candidate
Massachusetts State AGbd_575428465435b8372020-02-14Verified
California State AGbd_9995f453fd70a8fa2020-02-14Candidate
Montana State AGbd_dedaafa6f47142182020-02-14Candidate

Name: Mullen Coughlin LLC
norm: mullen coughlin

Name: Aveanna Healthcare LLC
norm: aveanna healthcare
Domain: aveanna.com
Industry: Healthcarellm

Discovered: Aug 24, 2019
Breach occurred: Jul 9, 2019 – Aug 24, 2019
Undetected for: 46 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 14, 2020
Affected individuals: 2,444state-resident count only
Data types: Identity (basic)Government IDFinancial account
Data elements: NameSocial Security numberDriver's licence numberFinancial account number
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 1-99dexposure 1-99d
WA-stated discovery: Found while ongoingContained same day
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Providing notice to other state and federal regulators, including the U.S. Department of Health and Human ServicesProviding notice to the three major credit reporting agencies
Initial access: valid_credentials

During the incident: Engaged outside computer forensics specialists
Changed the credentials for the involved email accounts
Provided notice to individuals
Provided complimentary access to twelve (12) months of credit monitoring and identity restoration services through TransUnion
Provided guidance on how to better protect against identity theft and fraud
Implemented additional security measures for employee email accounts and access to company systems including multi-factor authentication
Changes made: Implemented multi-factor authentication
Reviewed company policies and procedures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 25 weeks(174 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

HHS OCRFeb 14 · first

Massachusetts State AGFeb 14 · first

California State AGFeb 14 · first

Montana State AGFeb 14 · first

Washington State AGFeb 14 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10532.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 14, 2020
Raw hash: f9d0ad10fa3ae05588b81089db2df3931db450497a01a7af46745197e1cb76ef

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityMullen Coughlin LLC

Victim entityAveanna Healthcare LLC

Incidentdiscovered Aug 24, 2019

Stated responseEngaged outside computer forensics specialists

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com