AccidentalHealthcareProfessional ServicesHealthcareMisconfigurationCustomer Data InvolvedIdentity (basic)Health (basic)LowResolved

Open Practice

bd_dcd5395163f6c58f · schema v1 · pii pii-v1

Severity

Low

Discovered

Jun 26, 2025

Filed

Oct 10, 2025

To disclose

15 weeks

Affected

Not disclosed

Linked

5 filings

Confidence

65%

Full breach record for Open Practice →

Open Practice Solutions notified consumers of a misconfiguration in its billing portal on June 26, 2025, which lasted approximately five hours. The error potentially exposed billing information including names, provider names, dates of service, and services provided to another customer. SSNs, financial account details, and health insurance information were not involved. The company corrected the misconfiguration immediately and investigated the scope. No evidence of misuse was found.

J jump to incidentP pin to compareR raw source

Vermont clock✗ VT AG >45 bday15 weeks discovery → filing

Incident timeline

discovery → filing · 15 weeks / 106 days

Jun 26, 2025

Begins

Jun 26, 2025

Discovered

Oct 10, 2025

Filed

vs. sector median

+3 wks slower

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Washington State AGbd_657ec1805d4a31b42025-10-10Verified
California State AGbd_b2f9d95449270f602025-10-10Verified
Texas State AGbd_91061fd500e0407d2025-10-14 · +4dVerified
Illinois State AGbd_f4eeba1d1d2ded1e2025-10-01 · +9dCandidate

Name: Open Practice
norm: open practice
Domain: openpractice.net

Name: Open Practice
norm: open practice
Domain: openpractice.net
Industry: HealthcarellmProfessional Servicesllm

Discovered: Jun 26, 2025
Breach occurred: Jun 26, 2025 – Jun 26, 2025
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Identity (basic)Health (basic)
Attack vector: Misconfiguration

During the incident: Immediately launched an investigation
Immediately took steps to correct the misconfiguration
Conducted an investigation to determine the full scope of potentially accessed information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 15 weeks(106 days from discovery to filing)
Compliance flags: VT AG >45 bday
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Illinois State AGOct 1 · first

Washington State AG+9d

California State AG+9d

Vermont State AG+9d · this page

Texas State AG+13d

Pattern: first filing Oct 1 (IL), last Oct 14 (TX) — a 13-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ago.vermont.gov/document/2025-10-10-open-practice-solutions-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 10, 2025
Raw hash: 668a8e7611bb7a791d7e868e69693024dd63e459cd95c26fb025a55fd25f18ce

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityOpen Practice

Victim entityOpen Practice

Incidentdiscovered Jun 26, 2025

Stated responseImmediately launched an investigation

ComplianceVT AG >45 bday

Extraction provenanceno artifact recorded

Source provenanceago.vermont.gov