HackingHealthcareHealthcareData ExfiltratedCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Health (basic)PHIHighContained

Esse Health

bd_de426a2ba50bebf9 · schema v1 · pii pii-v1

Severity

High

Discovered

Apr 21, 2025

Filed

Jun 30, 2025

To disclose

10 weeks

Affected · nationwide

263,60118 in this filing

Linked

6 filings

Confidence

65%

Full breach record for Esse Health →

Esse Health, a healthcare provider, disclosed a cybersecurity incident on April 21, 2025, where a cybercriminal gained unauthorized access to its network and copied files. The breach affected 263,601 individuals nationwide, including 18 in Maine. Compromised data included names, addresses, dates of birth, health insurance info, medical record numbers, and certain health information. Notices were sent on June 25 and 30, 2025, offering 12 months of identity protection services.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Apr 21, 2025 → Filed with AG Jun 30, 202570d ⏱ ME AG >30d10 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 10 weeks / 70 days

Apr 21, 2025

Begins

Apr 21, 2025

Discovered

Jun 30, 2025

Filed

vs. sector median

3 wks faster

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Vermont State AGbd_0f559e2e213759252025-06-30Candidate
Massachusetts State AGbd_42902b01272db9572025-06-27 · +3dVerified
Indiana State AGbd_8579359a35c782372025-06-25 · +5dVerified
HHS OCRbd_f1219c8e28ac0ec02025-06-20 · +10dVerified

Show 1 more filing ↓up to 72d gap

Vermont State AGbd_ef0beb164e384a0f2025-09-10 · +72dVerified

Name: Esse Health
norm: esse health
Domain: essehealth.com
Industry: Healthcare

Name: Esse Health
norm: esse health
Domain: essehealth.com
Industry: Healthcare
Industry: Healthcarellm

Discovered: Apr 21, 2025
Breach occurred: Apr 21, 2025
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 25, 2025
Affected individuals: 263,601state + nationwide
Data types: Identity (basic)Health (basic)PHI
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 ChannelT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: Filed notification with Maine Attorney General
Initial access: exploit_public_facing

During the incident: Initiated an investigation with the assistance of external cybersecurity and forensic specialists
Notified law enforcement
Implemented additional security enhancements to further strengthen our defenses
Offering identity protection services at no charge through IDX
Changes made: Implemented additional security enhancements to further strengthen our defenses
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 10 weeks(70 days from discovery to filing)
Compliance flags: ME AG >30d · 70dME resident >60d · 65d
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Apr 21, 2025
→ Filed with AG: Jun 30, 2025
70d 30 days (soft) ME AG >30d
Maine
Discovered: Apr 21, 2025
→ Notified: Jun 25, 2025
65d 60 days (analyst band; statutory cap is 30 days) ME resident >60d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Apr 21, 2025 → Filed with AG: Jun 30, 2025	70d	30 days (soft)	ME AG >30d
Maine	Discovered: Apr 21, 2025 → Notified: Jun 25, 2025	65d	60 days (analyst band; statutory cap is 30 days)	ME resident >60d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 5 states

View merged incident ↗

HHS OCRJun 20 · first

Indiana State AG+5d

Massachusetts State AG+7d

Vermont State AG+10d

Maine State AG+10d · this page

Vermont State AG+82d

Pattern: first filing Jun 20 (MO), last Sep 10 (VT) — a 82-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/2374dd24-9fb6-41bf-ab1f-ce11920ffeb3.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 30, 2025
Raw hash: 9092410246778ca78c22590826a98bed2fd8ace08e5e960269ed6c693ec49829

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityEsse Health

Victim entityEsse Health

Incidentdiscovered Apr 21, 2025

Stated responseInitiated an investigation with the assistance of external cybersecurity and forensic specialists

ComplianceME AG >30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov