HackingHealthcareProfessional ServicesHealthcareVulnerability ExploitSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedPHIIdentity (basic)LowContained

BAESMAN GROUP

bd_dd0e6d5ccd2249d0 · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Feb 12, 2024

To disclose

—

Affected

Not disclosed

Linked

6 filings

Confidence

66%

Full breach record for BAESMAN GROUP →3 incidents on file

Baesman Group, Inc. notified the California AG of a data breach involving unauthorized access to a third-party MOVEit Transfer server on May 29, 2023. An unknown actor exploited security issues in Progress Software's MOVEit tool to access and exfiltrate data. Affected individuals' names and health-related data were involved. Baesman Group is a service provider to health plans administered by Elevance Health entities. The company launched an investigation, reviewed impacted data, and is enhancing privacy policies.

J jump to incidentP pin to compareR raw source

Incident timeline

May 29, 2023

Begins

Feb 12, 2024

Filed

This filing is one of 6 about the same incident.View merged incident

Part of Progress Software Corporation supply-chain incident (2023) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Montana State AGbd_6f0ff7c39c7e50842024-02-05 · +7dCandidate
Oregon State AGbd_47adc8a39b47e7952024-02-29 · +17dVerified
California State AGbd_808fe2ae0525500f2024-02-29 · +17dVerified
Washington State AGbd_be036d2299c0c6a22024-02-29 · +17dVerified

Show 1 more filing ↓up to 17d gap

Massachusetts State AGbd_f040b7be18297b812024-02-29 · +17dVerified

Name: BAESMAN GROUP
norm: baesman group

Name: BAESMAN GROUP
norm: baesman group
Industry: HealthcarellmProfessional Servicesllm

Discovered: —
Breach occurred: May 29, 2023 – May 29, 2023
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: PHIIdentity (basic)
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain CompromiseT1041 Exfiltration Over C2 Channel
Threat actor: External
Third party: via Progress Software Corp.
Initial access: supply_chain

During the incident: Moved quickly to take steps recommended by Progress to remedy the issues
Promptly launched an investigation to determine the potential impact of the issues on the security of data in the MOVEit Transfer server
Reviewed the data on the server at the time of the incident to determine who the data was related to and the contents for purposes of providing notice
Notifying potentially affected individuals
Changes made: Reviewing and enhancing existing policies and procedures related to data privacy to reduce the likelihood of a similar future event
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 5 states

View merged incident ↗

Montana State AGFeb 5 · first

California State AG+7d · this page

Oregon State AG+24d

California State AG+24d

Washington State AG+24d

Massachusetts State AG+24d

Pattern: first filing Feb 5 (MT), last Feb 29 (MA) — a 24-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-580879
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 12, 2024
Raw hash: 0d28e455ced731ebf0870bb624749cd4d9e34564ee95ade9239c736a203e0bf6

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityBAESMAN GROUP

Victim entityBAESMAN GROUP

IncidentThird-Party / Supply Chain

Stated responseMoved quickly to take steps recommended by Progress to remedy the issues

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov