HackingCustomer Data InvolvedIdentity (basic)Government IDMediumContained

Health Resources in Action, Inc.

bd_d9bb4eb626adfaf1 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 24, 2024

Filed

May 28, 2024

To disclose

5 weeks

Affected · nationwide

31 in this filing

Confidence

65%

Full breach record for Health Resources in Action, Inc. →

Health Resources in Action, Inc. experienced an external system breach on March 29, 2024, which was discovered on April 24, 2024. The incident compromised the name and Social Security number of one Maine resident. The company began notifying affected individuals on May 28, 2024, and offered 24 months of complimentary credit monitoring and identity theft protection services through Experian.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Apr 24, 2024 → Filed with AG May 28, 202434d ⏱ ME AG >30d5 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 26 days

discovery → filing · 5 weeks / 34 days

Mar 29, 2024

Begins

Apr 24, 2024

Discovered

May 28, 2024

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed3 affectedView incident

Name: Health Resources in Action, Inc.
norm: health resources in action

Name: Health Resources in Action, Inc.
norm: health resources in action

Discovered: Apr 24, 2024
Breach occurred: Mar 29, 2024
Undetected for: 26 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 28, 2024
Affected individuals: 3state + nationwide
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Unauthorized Access
Threat actor: External

During the incident: Offered 24 months of credit monitoring and identity theft protection services through Experian
Sent written notification to affected individuals
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(34 days from discovery to filing)
Compliance flags: ME AG >30d · 34d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Apr 24, 2024
→ Filed with AG: May 28, 2024
34d 30 days (soft) ME AG >30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Apr 24, 2024 → Filed with AG: May 28, 2024	34d	30 days (soft)	ME AG >30d

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/cf2a65b9-c0a7-41dc-8886-8698f32a6b7a.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 28, 2024
Raw hash: a7bb7e7486d7461f8a9b1f6c25d6c584ffd0d723d4f042354401e75ed99f1bcf

Reporting entityHealth Resources in Action, Inc.

Victim entityHealth Resources in Action, Inc.

Incidentdiscovered Apr 24, 2024

Stated responseOffered 24 months of credit monitoring and identity theft protection services through Experian

ComplianceME AG >30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov