HackingHealthcareHealthcareStolen CredentialsTargetedCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDHealth (basic)PHIMediumContained

Med-A-Vision, Inc.

bd_f3a76876ff71882a · schema v1 · pii pii-v1

Severity

Medium

Discovered

Dec 10, 2024

Filed

Feb 19, 2025

To disclose

10 weeks

Affected · nationwide

4039 in this filing

Confidence

66%

Full breach record for Med-A-Vision, Inc. →2 incidents on file

Med-A-Vision, Inc. reported an unauthorized access to an email box on December 10, 2024, affecting 40 individuals (39 Maine residents). The breach involved personal health information and PII (SSN, DOB). The actor used valid credentials. No evidence of exfiltration was found. IDX credit monitoring was offered.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Dec 10, 2024 → Filed with AG Feb 19, 202571d ⏱ ME AG >30d10 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 1 days

discovery → filing · 10 weeks / 71 days

Dec 9, 2024

Begins

Dec 10, 2024

Discovered

Feb 19, 2025

Filed

vs. sector median

2 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed40 affectedView incident

Name: Marshall Dennehey Warner Coleman & Goggin, P.A.
norm: marshall dennehey warner coleman goggin

Name: Med-A-Vision, Inc.
norm: med a vision
Industry: Healthcarellm

Discovered: Dec 10, 2024
Breach occurred: Dec 9, 2024
Undetected for: 1 dayoccurrence → discovery
Materiality determined: —
Notification sent: Feb 19, 2025
Affected individuals: 40state + nationwide
Data types: Identity (basic)Government IDHealth (basic)PHI
Data elements: Social Security numberDate of birthMedical information
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: External
Regulator citations: Filed notification with Maine Attorney General
Initial access: valid_credentials

During the incident: Working with investigators and security firms
Identified the method by which the threat actor entered into our system and corrected it
Reviewed internal data management and protocols
Implemented enhanced security measures
Offered one year of IDX credit monitoring and identity protection services
Changes made: Developing improved security measures
Implementing safeguards related to data security
Reviewing internal data management and protocols
Implementing enhanced security measures to help prevent recurrence
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 10 weeks(71 days from discovery to filing)
Compliance flags: ME AG >30d · 71d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Dec 10, 2024
→ Filed with AG: Feb 19, 2025
71d 30 days (soft) ME AG >30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Dec 10, 2024 → Filed with AG: Feb 19, 2025	71d	30 days (soft)	ME AG >30d

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/854429c2-80f4-453d-b911-7663cbb46fde.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 19, 2025
Raw hash: 2a5fa1680e1f1ae9e9010e5ae9252dcb1bb45734e98a14547eabe76be4457fa5

Reporting entityMarshall Dennehey Warner Coleman & Goggin, P.A.

Victim entityMed-A-Vision, Inc.

Incidentdiscovered Dec 10, 2024

Stated responseWorking with investigators and security firms

ComplianceME AG >30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov