HackingHealthcareHealthcareCustomer Data InvolvedPIIIdentity (basic)HighContained

Ravkoo

bd_e4f82f363cdb1218 · schema v1 · pii pii-v1

Severity

High

Discovered

Sep 27, 2021

Filed

Jan 5, 2022

To disclose

14 weeks

Affected · nationwide

105,000368 in this filing

Linked

11 filings

Confidence

66%

Full breach record for Ravkoo →

Ravkoo, a healthcare entity based in Auburndale, Florida, reported an internal system breach occurring between September 27, 2021, and December 7, 2021. The incident affected 105,000 individuals, including 368 Maine residents. Notification was sent on January 3, 2022, offering 12 months of credit monitoring and identity theft protection via Kroll. The breach was described as an 'internal system breach' involving unauthorized access.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Sep 27, 2021 → Filed with AG Jan 5, 2022100d ✗ ME AG >90d14 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 14 weeks / 100 days

Sep 27, 2021

Begins

Sep 27, 2021

Discovered

Jan 5, 2022

Filed

vs. sector median

+3 wks slower

This filing is one of 11 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

Oregon State AGbd_e271be692c34e9322022-01-05Verified
South Carolina State AGbd_b1c21d4401605dcb2022-01-04 · +1dVerified
Massachusetts State AGbd_2ce90ff564900d0d2022-01-03 · +2dVerified
HHS OCRbd_3dd01437251dd7992022-01-03 · +2dVerified

Show 6 more filings ↓up to 4d gap

Washington State AGbd_4b4f4f311c81eaee2022-01-03 · +2dVerified
California State AGbd_d601b80a961402702022-01-03 · +2dVerified
New Hampshire State AGbd_d90f0cc5f913c2be2022-01-03 · +2dVerified
Montana State AGbd_e92fcd9fc02d394a2022-01-03 · +2dVerified
Indiana State AGbd_fc5c1d10a6aef0942022-01-03 · +2dVerified
Illinois State AGbd_a6db1f6b29469b452022-01-01 · +4dCandidate

Name: Ravkoo
norm: ravkoo

Name: Ravkoo
norm: ravkoo
Industry: Healthcarellm

Discovered: Sep 27, 2021
Breach occurred: Sep 27, 2021 – Dec 7, 2021
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 3, 2022
Affected individuals: 105,000state + nationwide
Data types: PIIIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Filed data breach notice with Maine Attorney General
Initial access: valid_credentials

During the incident: Sent written notification to affected individuals
Offered 12 months of credit monitoring through Kroll
Offered 12 months of identity theft protection through Kroll
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 14 weeks(100 days from discovery to filing)
Compliance flags: ME AG >90d · 100dME resident >60d · 98d
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Sep 27, 2021
→ Filed with AG: Jan 5, 2022
100d 90 days ME AG >90d
Maine
Discovered: Sep 27, 2021
→ Notified: Jan 3, 2022
98d 60 days (analyst band; statutory cap is 30 days) ME resident >60d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Sep 27, 2021 → Filed with AG: Jan 5, 2022	100d	90 days	ME AG >90d
Maine	Discovered: Sep 27, 2021 → Notified: Jan 3, 2022	98d	60 days (analyst band; statutory cap is 30 days)	ME resident >60d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 11 states

View merged incident ↗

Illinois State AGJan 1 · first

Massachusetts State AG+2d

HHS OCR+2d

Washington State AG+2d

California State AG+2d

New Hampshire State AG+2d

Montana State AG+2d

Indiana State AG+2d

South Carolina State AG+3d

Oregon State AG+4d

Maine State AG+4d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/142a7ad5-bef3-40c5-ac1c-f24d64014174.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 5, 2022
Raw hash: 3bb328088caa08c2dc5a54df294f15b9c9edf8ad9ad5f6b44a37b8fca83b2b0e

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entityRavkoo

Victim entityRavkoo

Incidentdiscovered Sep 27, 2021

Stated responseSent written notification to affected individuals

ComplianceME AG >90d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov