MalwareProfessional ServicesProfessional ServicesRansomwareData ExfiltratedSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)Government IDPHIHealth (basic)HighContained

Health Analytics Practice Group

bd_e4ba1a5134b4067e · schema v1 · pii pii-v1

Severity

High

Discovered

Sep 14, 2023

Filed

Apr 25, 2024

To disclose

32 weeks

Affected

1,888state residents only

Linked

3 filings

Confidence

69%

Full breach record for Health Analytics Practice Group →

Berry, Dunn, McNeil & Parker, LLC reported a ransomware incident affecting its vendor, Health Analytics Practice Group (HAPG). An unauthorized actor accessed Reliable Networks of Maine, LLC's network, exfiltrating personal information (names, addresses) from HAPG systems. The breach was discovered on September 14, 2023, and notifications were sent on April 11, 2024, to 1,888 Washington residents. Identity theft protection services were offered.

J jump to incidentP pin to compareR raw source

Washington clock✗ WA AG >90d32 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 2 days

discovery → filing · 32 weeks / 224 days

Sep 12, 2023

Begins

Sep 14, 2023

Discovered

Apr 25, 2024

Filed

vs. sector median

+13 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

South Carolina State AGbd_32f255694d934b9c2024-04-26 · +1dCandidate
Vermont State AGbd_f5763ecf612764632024-05-23 · +28dVerified

Name: Berry, Dunn, McNeil & Parker, LLC
norm: berry dunn mcneil parker

Name: Health Analytics Practice Group
norm: health analytics practice
Industry: Professional Servicesllm

Discovered: Sep 14, 2023
Breach occurred: Sep 12, 2023 – Sep 14, 2023
Undetected for: 2 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 11, 2024
Affected individuals: 1,888state-resident count only
Data types: Identity (basic)
Data elements: NameSocial Security numberDriver's licence numberDate of birthPassport numberHealth insurance IDMedical information
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 1-99dexposure 1-99d
WA-stated discovery: Found while ongoingContained same day
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Initial access: external_remote_services

During the incident: Implemented incident response protocols
Engaged cybersecurity experts to assist with determining what occurred and whether any data was compromised
Hired a vendor to conduct an in-depth review of the impacted data
Decommissioned all BerryDunn systems under Reliable’s control
Migrated all HAPG data to secure internal BerryDunn systems
Offering identity theft protection services through IDX
Changes made: Decommissioned all BerryDunn systems under Reliable’s control
Migrated all HAPG data to secure internal BerryDunn systems that are continually monitored as part of our cybersecurity program
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 32 weeks(224 days from discovery to filing)
Compliance flags: WA AG >90d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Washington State AGApr 25 · first · this page

South Carolina State AG+1d

Vermont State AG+28d

Pattern: first filing Apr 25 (WA), last May 23 (VT) — a 28-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA28878.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 25, 2024
Raw hash: 9ead3c762fc0910ad5ffab8954d3a57cda59c47044c642bde567bd3abb1d96ac

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityBerry, Dunn, McNeil & Parker, LLC

Victim entityHealth Analytics Practice Group

Incidentdiscovered Sep 14, 2023

Stated responseImplemented incident response protocols

ComplianceWA AG >90d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com