HackingHealthcareTechnologyHealthcareStolen CredentialsCustomer Data InvolvedData ExfiltratedIdentity (basic)Government IDPIIHighContained

AKUMIN OPERATING CORP.

bd_ee2355bc545555b4 · schema v1 · pii pii-v1

Severity

High

Discovered

Oct 12, 2023

Filed

Dec 23, 2024

To disclose

15 months

Affected

15,438state residents only

Linked

7 filings

Confidence

67%

Full breach record for AKUMIN OPERATING CORP. →5 incidents on file

Akumin, Inc. notified New Hampshire residents of a data breach involving unauthorized access to patient information. The incident, first identified in October 2023, resulted in the exposure of personal and government-issued identifiers. Akumin isolated its network, rebuilt systems, and notified federal and state regulators. Approximately 15,438 NH residents were affected.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 15 months / 438 days

Oct 12, 2023

Discovered

Dec 23, 2024

Filed

vs. sector median

+53 wks slower

This filing is one of 7 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

Montana State AGbd_31930fb683ccf8b82024-12-23Candidate
Indiana State AGbd_647223fbc4b0f6c62024-12-23Verified
California State AGbd_db7efd6c0c4d9e1a2024-12-23Verified
Washington State AGbd_e16c383f2f31d7722024-12-23Verified

Show 2 more filings ↓up to 4d gap

Vermont State AGbd_eb1cfb9c9e6261dc2024-12-23Verified
South Carolina State AGbd_9341eb013fc58c2e2024-12-27 · +4dVerified

Name: AKUMIN OPERATING CORP.
norm: akumin operating

Name: AKUMIN OPERATING CORP.
norm: akumin operating
Industry: HealthcarellmTechnologyllm

Discovered: Oct 12, 2023
Materiality determined: —
Notification sent: Dec 29, 2023
Affected individuals: 15,438state-resident count only
Data types: Identity (basic)Government IDPII
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Regulator citations: Notified the Securities Exchange CommissionNotified the U.S. Department of Health and Human ServicesIssued supplemental notification to HHSProvided notifications to the Office of the Attorney General in Connecticut, Illinois, Massachusetts, Montana, Nebraska, and New YorkNotified the Consumer Reporting Agencies
Initial access: valid_credentials

During the incident: Proactively isolated and quarantined its computer network from the internet
Took steps to confirm the security of its network
Securely rebuilt its systems
Undertook additional steps to further enhance the security of its systems
Notified federal law enforcement
Changes made: Securely rebuilt its systems
Undertook additional steps to further enhance the security of its systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 15 months(438 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 7 states

View merged incident ↗

Montana State AGDec 23 · first

Indiana State AGDec 23 · first

California State AGDec 23 · first

Washington State AGDec 23 · first

Vermont State AGDec 23 · first

New Hampshire State AGDec 23 · first · this page

South Carolina State AG+4d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/akumin-20241223.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 23, 2024
Raw hash: 68d9988c5cd5946d69744d5145f158c26069c8530835be2d9d29e3a7c5cc647f

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityAKUMIN OPERATING CORP.

Victim entityAKUMIN OPERATING CORP.

Incidentdiscovered Oct 12, 2023

Stated responseProactively isolated and quarantined its computer network from the internet

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov