AccidentalMisconfigurationData ExfiltratedCustomer Data InvolvedIDENTITY_BASICHEALTH_BASICLowContained
ATHENAHEALTH, INC.
bd_e9e06934e266ff55 · schema v1 · pii pii-v1
Full breach record for ATHENAHEALTH, INC. →athenahealth, Inc. notified the Idaho Attorney General on November 15, 2024, of a cybersecurity incident affecting one Idaho resident. The incident involved the inadvertent upload of Eligibility Transaction Files to a publicly accessible internet repository due to a manual configuration error by an employee. The files contained demographic and clinical data (names, addresses, DOB, provider info) but no financial or SSN data. athenahealth removed the files, investigated, and provided 12 months of Experian IdentityWorks to the affected individual.
This filing is one of 4 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (3) · sorted by filing gap
- bd_4578d2cfe6b20643Montana State AGfiled 2024-11-15Candidate
- bd_8ba652ba3e10c74bNew Hampshire State AGfiled 2024-11-15Verified
- bd_dda00b7398f09ba5Indiana State AGfiled 2024-11-15Verified
Source provenance
- Source URL
- https://www.ag.idaho.gov/content/uploads/2024/11/11-15-2024-athenahealth-Inc.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Nov 15, 2024
- Raw hash
- 2648dcf359f274bfbac0ab9bb54d5701e86679638572526cabfe0f2754f34557
Reporting entity
- Name
- McDermott Will & Emery LLPnorm: mcdermott will emery
Victim entity
- Name
- ATHENAHEALTH, INC.norm: athenahealth
- Domain
- athenahealth.com
Incident
- Discovered
- Sep 16, 2024
- Materiality determined
- —
- Notification sent
- Nov 15, 2024
- Affected individuals
- 1
- Data types
- IDENTITY_BASICHEALTH_BASIC
- Attack vector
- Misconfiguration
- MITRE ATT&CK
- T1535 Unauthorized Access to Cloud Storage
- Threat actor
- Internal
- Regulator citations
- Notified the Department of Health and Human Services, Office for Civil Rights of this incident on November 15, 2024
Compliance
- Time to disclose
- 9 weeks(60 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.