HackingHealthcareTechnologyHealthcareVulnerability ExploitStolen CredentialsCustomer Data InvolvedBusiness Associate (HIPAA)Downstream VictimsPHIHealth (basic)Identity (basic)LowContained

Friends of Family Health Center

bd_d731ae63f6528c4a · schema v1 · pii pii-v1

Severity

Low

Discovered

Oct 2, 2025

Filed

Dec 16, 2025

To disclose

11 weeks

Affected

Not disclosed

Confidence

64%

Full breach record for Friends of Family Health Center →2 incidents on file

TriZetto Provider Solutions (TPS) disclosed a security incident affecting its healthcare provider customers, including OCHIN. The breach occurred on November 1, 2024, but was discovered on October 2, 2025, when suspicious activity was detected. TPS contained the incident by disabling affected users and IPs. An investigation by Mandiant confirmed the vulnerability was remediated. TPS is offering identity monitoring services to affected individuals and assisting providers with regulatory notifications to OCR and state Attorneys General. The incident involved unauthorized access to protected health information.

J jump to incidentP pin to compareR raw source

California clockDiscovered Oct 2, 2025 → Notified Jan 5, 202695d ✗ CA 60-day late11 weeks discovery → filing

Incident timeline

undetected · 335 days

discovery → filing · 11 weeks / 75 days

Nov 1, 2024

Begins

Oct 2, 2025

Discovered

Dec 16, 2025

Filed

vs. sector median

on median

Part of TriZetto Provider Solutions supply-chain incident (2025) — a supply-chain cascade affecting multiple organizations.View cascade →

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: TriZetto Provider Solutions
norm: trizetto provider
Domain: trizettoprovider.com

Name: Friends of Family Health Center
norm: friends of family health center
Industry: HealthcarellmTechnologyllm

Discovered: Oct 2, 2025
Breach occurred: Nov 1, 2024
Undetected for: 335 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 5, 2026
Affected individuals: Not disclosed
Data types: PHIHealth (basic)Identity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: External
Regulator citations: Offering to notify the U.S. Department of Health and Human Services Office for Civil Rights (OCR)Offering to notify certain state Attorneys General and privacy regulatorsOffering to notify prominent media outlets on behalf of affected providers
Initial access: exploit_public_facing

During the incident: Contained the incident immediately upon discovering suspicious activity on October 2, 2025, by disabling all users and IP addresses associated with the suspicious activity
Engaged cybersecurity experts, Mandiant, to assist with the investigation
Reviewed the security of TPS’s systems
Remediated the vulnerability from the incident
Deployed additional recommendations from Mandiant
Continues to work with Mandiant to further enhance the security of its systems
Engaged notification vendor, Kroll, to notify affected provider customers
Provided access to a notification support portal hosted by Kroll
Offered identity monitoring services at no cost—including Credit Monitoring, Fraud Consultation, and Identity Theft Restoration services—provided by Kroll
Operated a dedicated call center and technical support team from Kroll for at least 90 days
Changes made: Remediated the vulnerability from the incident
Deployed additional recommendations from Mandiant
Continues to work with Mandiant to further enhance the security of its systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 11 weeks(75 days from discovery to filing)
Compliance flags: CA 60-day late · 95dCA AG copy ≤15d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Oct 2, 2025
→ Notified: Jan 5, 2026
95d 60 days (analyst band, pre-2026 discoveries) CA 60-day late
California
Consumers notified: Jan 5, 2026
→ AG copy submitted: Dec 16, 2025
— 15 calendar days CA AG copy ≤15d

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Oct 2, 2025 → Notified: Jan 5, 2026	95d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late
California	Consumers notified: Jan 5, 2026 → AG copy submitted: Dec 16, 2025	—	15 calendar days	CA AG copy ≤15d

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-615860
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 16, 2025
Raw hash: 73971ac595b9398cb46f0ad293009a25a18ae93a759de729374128bb79b8ea13

Reporting entityTriZetto Provider Solutions

Victim entityFriends of Family Health Center

Incidentdiscovered Oct 2, 2025

Stated responseContained the incident immediately upon discovering suspicious activity on October 2, 2025, by disabling all users and IP addresses associated with the suspicious activity

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov