HackingHealthcareHealthcareSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)Government IDFinancial accountHealth (basic)PHIMediumContained

CardioVascular Health Clinic

bd_e9eb9f720993c2bf · schema v1 · pii pii-v2

Severity

Medium

Discovered

Mar 4, 2025

Filed

Nov 26, 2025

To disclose

—

Affected

Not disclosed

Linked

4 filings

Confidence

65%

Full breach record for CardioVascular Health Clinic →2 incidents on file

CardioVascular Health Clinic notified affected individuals of a cybersecurity event involving unauthorized access to cloud services between Feb 18 and Mar 4, 2025. The breach exposed PII, PHI, and financial data. The clinic engaged forensic specialists, notified law enforcement, and provided credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 14 days

Feb 18, 2025

Begins

Mar 4, 2025

Discovered

Nov 26, 2025

Filed

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Massachusetts State AGbd_1bbd9627cebf0e3e2025-11-26Verified
Vermont State AGbd_45e946446233ef6b2025-11-26Candidate
Illinois State AGbd_7b9e87efd54c31772025-12-01 · +5dVerified

Name: CardioVascular Health Clinic
norm: cardiovascular health clinic

Name: CardioVascular Health Clinic
norm: cardiovascular health clinic
Industry: Healthcarellm

Discovered: Mar 4, 2025
Breach occurred: Feb 18, 2025 – Mar 4, 2025
Undetected for: 14 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 26, 2025
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDFinancial accountHealth (basic)PHI
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain Compromise
Threat actor: External
Initial access: supply_chain

During the incident: Engaged third-party forensic specialists to investigate this matter
Notified federal law enforcement
Arranged for you to activate, at no cost to you, an online credit monitoring service for 12 months/24 months provided by IDX
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Massachusetts State AGNov 26 · first

Vermont State AGNov 26 · first

Nebraska State AGNov 26 · first · this page

Illinois State AG+5d

Pattern: first filing Nov 26 (MA), last Dec 1 (IL) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://nebraska.gov/ago/data-breach/documents/9df99b75-b91e-4aa7-8c8d-f8339d5c7bb3.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 26, 2025
Raw hash: c600c12806addea6fc07652b2d3fb3465ae4a7782cc15fafb8e1e75f05ef890b

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityCardioVascular Health Clinic

Victim entityCardioVascular Health Clinic

Incidentdiscovered Mar 4, 2025

Stated responseEngaged third-party forensic specialists to investigate this matter

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancenebraska.gov