Social EngineeringPhishingCustomer Data InvolvedEmployee Data InvolvedIDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTHEALTH_BASICMediumContained
Montana Health Solutions
bd_ef990a131be2b252 · schema v1 · pii pii-v1
Full breach record for Montana Health Solutions →Montana Health Solutions (MHS) notified the Maryland Attorney General of a data security incident involving 735 Maryland residents. On September 17, 2024, MHS detected unauthorized activity related to an employee email account, likely resulting from a phishing attack. The breach potentially exposed names, Social Security numbers, driver's license information, financial account details, and health/employment data. MHS secured systems, launched an investigation, and provided 12 months of free Experian IdentityWorks services to affected individuals.
Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed735 affectedView incident
Source provenance
- Source URL
- https://oag.maryland.gov/resources-info/SBN%20Documents/2025/ITU-376812.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Apr 23, 2026
- Raw hash
- a6bad83e90fd4ba2d728d5b0f3a12720f87b67567c0a39489f03688fb2febc72
Reporting entity
- Name
- Constangy, Brooks, Smith & Prophete, LLPnorm: constangy brooks smith prophete
Victim entity
- Name
- Montana Health Solutionsnorm: montana health
Incident
- Discovered
- Sep 17, 2024
- Materiality determined
- —
- Notification sent
- Mar 19, 2025
- Affected individuals
- 735
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTHEALTH_BASIC
- Attack vector
- Phishing
- MITRE ATT&CK
- T1566.002 Spearphishing Link
- Threat actor
- ExternalFinancial
- Regulator citations
- Notified Maryland Attorney General
- Initial access
- phishing_link
Compliance
- Time to disclose
- 19 months(583 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.