HackingHealthcareHealthcareData ExfiltratedCustomer Data InvolvedGovernment IDHealth (basic)MediumContained

AuthoraCare Collective

bd_f5a32e5bbf3db4e1 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 22, 2024

Filed

Mar 13, 2025

To disclose

29 weeks

Affected

14state residents only

Linked

5 filings

Confidence

64%

Full breach record for AuthoraCare Collective →2 incidents on file

AuthoraCare Collective notified South Carolina residents of a data security breach occurring between August 18-22, 2024. An unauthorized actor accessed systems containing names, Social Security numbers, and medical diagnoses. AuthoraCare engaged outside IT experts, secured systems, notified law enforcement and HHS OCR, and provided 12 months of credit monitoring and fraud assistance via TransUnion/Cyberscout.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 4 days

discovery → filing · 29 weeks / 203 days

Aug 18, 2024

Begins

Aug 22, 2024

Discovered

Mar 13, 2025

Filed

vs. sector median

+17 wks slower

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Massachusetts State AGbd_075a3147b372fc402025-03-13Verified
New Hampshire State AGbd_4d16b6e9911708572025-03-12 · +1dVerified
Maine State AGbd_ce2cbf01e68366c72025-03-11 · +2dCandidate
Indiana State AGbd_381b87b78fbfee062025-04-10 · +28dVerified

Name: AuthoraCare Collective
norm: authoracare collective

Name: AuthoraCare Collective
norm: authoracare collective
Industry: Healthcarellm

Discovered: Aug 22, 2024
Breach occurred: Aug 18, 2024 – Aug 22, 2024
Undetected for: 4 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 2, 2025
Affected individuals: 14state-resident count only
Data types: Government IDHealth (basic)
Data elements: Social Security numberMedical information
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Regulator citations: Reported the incident to law enforcementReported the incident to the Department of Health and Human Services with the Office of Civil Rights
Initial access: exploit_public_facing

During the incident: Engaged outside IT experts (at the direction of counsel) to investigate
Secured our systems
Notified law enforcement and will cooperate with their investigation
Reported the incident to the Department of Health and Human Services with the Office of Civil Rights
Provided access to Single Bureau Credit Monitoring/Single Bureau Credit Report/Single Bureau Credit Score services at no cost
Provided proactive fraud assistance through Cyberscout, a TransUnion company
Changes made: Secured our network
Addressed and investigated the incident
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 29 weeks(203 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Maine State AGMar 11 · first

New Hampshire State AG+1d

Massachusetts State AG+2d

South Carolina State AG+2d · this page

Indiana State AG+30d

Pattern: first filing Mar 11 (ME), last Apr 10 (IN) — a 30-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/AuthoraCareCollective.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 13, 2025
Raw hash: a1dba0c3ada14cb3ba715c2a21086b2760d90f3e5b39207b5ba83bab6205b60a

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityAuthoraCare Collective

Victim entityAuthoraCare Collective

Incidentdiscovered Aug 22, 2024

Stated responseEngaged outside IT experts (at the direction of counsel) to investigate

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceconsumer.sc.gov