HackingStolen CredentialsData ExfiltratedCustomer Data InvolvedEmployee Data InvolvedSupply Chain (3P Vendor)IDENTITY_BASICIDENTITY_GOVERNMENTMediumContained
Rightway Healthcare
bd_f61d60ea19fdbe7b · schema v1 · pii pii-v1
Full breach record for Rightway Healthcare →Davis Polk & Wardwell LLP notified individuals of a security incident involving its third-party healthcare benefits provider, Rightway Healthcare. On September 23, 2023, Rightway determined unauthorized access occurred to a decommissioned legacy environment. The attacker exfiltrated HR files from 2019-2020 containing personal information of Davis Polk employees, partners, and dependents. Davis Polk engaged forensic review, made regulatory notifications, and offered 24 months of credit monitoring via Experian. The incident involved identity data (SSNs, DOBs) but no PHI.
Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident
Source provenance
- Source URL
- https://mm.nh.gov/files/uploads/doj/remote-docs/davis-polk-wardwell-20231114.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Nov 14, 2023
- Raw hash
- 59bef2bc8eebd421eb2dfcc7dcb46e2b3fd321b044a86d0fd50dd89ac411d02e
Reporting entity
- Name
- DAVIS POLK & WARDWELL LLPnorm: davis polk wardwell
Victim entity
- Name
- Rightway Healthcarenorm: rightway healthcare
Incident
- Discovered
- Sep 23, 2023
- Materiality determined
- —
- Notification sent
- Nov 13, 2023
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENT
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
- Threat actor
- External
- Regulator citations
- Made regulatory notifications to the extent required
- Initial access
- valid_credentials
Compliance
- Time to disclose
- 7 weeks(52 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.