MalwareRetail & ConsumerHealthcareRetailRansomwareData ExfiltratedCustomer Data InvolvedPIIFinancial accountIdentity (basic)MediumContained

Your Patient Advisor by Captify Health

bd_f777f29d18672117 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 4, 2021

Filed

Dec 22, 2022

To disclose

22 months

Affected

36,364state residents only

Linked

7 filings

Confidence

69%

Full breach record for Your Patient Advisor by Captify Health →

Your Patient Advisor by Captify Health, an online retailer of colonoscopy preparation kits, reported a data security incident in Washington. Malware compromised its website, exposing personal information including names, addresses, and payment card details (number, expiration, security code) of 36,364 Washington residents. The incident was discovered in March 2021 following reports of fraudulent credit card use, and notifications were sent to affected individuals in December 2022.

J jump to incidentP pin to compareR raw source

Washington clock✗ WA AG >90d22 months discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 22 months / 658 days

Mar 4, 2021

Begins

Mar 4, 2021

Discovered

Dec 22, 2022

Filed

vs. sector median

+85 wks slower

This filing is one of 7 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

New Hampshire State AGbd_78420314833109b82022-12-22Verified
California State AGbd_c0fb5a5e9c1a0c992022-12-22Verified
Maine State AGbd_d2a62c54889c4e2b2022-12-22Verified
Massachusetts State AGbd_cd58557de0174fea2022-12-26 · +4dVerified

Show 2 more filings ↓up to 6d gap

Indiana State AGbd_16690b37c070f9f82022-12-16 · +6dVerified
Montana State AGbd_42009594f256a9ff2022-12-16 · +6dCandidate

Name: Your Patient Advisor by Captify Health
norm: your patient advisor by captify health

Name: Your Patient Advisor by Captify Health
norm: your patient advisor by captify health
Industry: Retail & ConsumerllmHealthcarellm

Discovered: Mar 4, 2021
Breach occurred: Mar 4, 2021
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 16, 2022
Affected individuals: 36,364state-resident count only
Data types: PIIFinancial accountIdentity (basic)
Data elements: NameFinancial account number
WA-stated cause: Cyberattack
WA-stated duration: lifecycle Unknowndexposure Unknownd
WA-stated discovery: Found after the fact
Attack vector: Unknown
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: Notified Washington Attorney General

During the incident: Engaged an independent computer forensics firm to investigate its online ordering platform
Notified all impacted individuals via U.S. First-Class Mail
Established a toll-free call center through IDX to answer any questions about the incident and address related concerns
Changes made: Implemented additional security measures to secure its online ordering platform to reduce the risk of a similar incident occurring in the future
Took steps to ensure its platform is safe and secure for all purchase
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 22 months(658 days from discovery to filing)
Compliance flags: WA AG >90d
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 7 states

View merged incident ↗

Indiana State AGDec 16 · first

Montana State AGDec 16 · first

New Hampshire State AG+6d

California State AG+6d

Maine State AG+6d

Washington State AG+6d · this page

Massachusetts State AG+10d

Pattern: first filing Dec 16 (IN), last Dec 26 (MA) — a 10-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM15100.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 22, 2022
Raw hash: 9f8259be305c942a5d5d87f6b9977bc493c6710a3230afea56d49e79d73f5f12

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityYour Patient Advisor by Captify Health

Victim entityYour Patient Advisor by Captify Health

Incidentdiscovered Mar 4, 2021

Stated responseEngaged an independent computer forensics firm to investigate its online ordering platform

ComplianceWA AG >90d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com