HackingHealthcareHealthcareCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Government IDFinancial accountCredentialsHealth (basic)PHIMediumContained

Heartland Health Center

bd_fba45e2f4449c4ea · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 4, 2025

Filed

Oct 21, 2025

To disclose

37 weeks

Affected

Not disclosed

Linked

5 filings

Confidence

65%

Full breach record for Heartland Health Center →5 incidents on file

Heartland Health Center notified consumers of a data breach discovered on February 4, 2025, involving unauthorized access by an unknown third party. The incident exposed names, SSNs, DOBs, driver's license numbers, financial account numbers, usernames, and PHI including medical diagnoses and Medicare numbers. The organization engaged forensic consultants, secured systems, and offered 12 months of credit monitoring. No specific count of affected individuals was disclosed in the filing.

J jump to incidentP pin to compareR raw source

Vermont clock✗ VT AG >45 bday37 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

discovery → filing · 37 weeks / 259 days

Feb 4, 2025

Discovered

Oct 21, 2025

Filed

vs. sector median

+25 wks slower

This filing is one of 5 about the same incident.View merged incident

A leak claim by lockbit_3 about this victim predates this filing by 579 days.View originating leak claim

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Montana State AGbd_647209df288b0fc32025-10-21Verified
Massachusetts State AGbd_b8d6da33aca4814b2025-10-21Verified
HHS OCRbd_5f6155b7de4c7d602025-10-17 · +4dVerified
Indiana State AGbd_b8679ec8856a290a2025-10-17 · +4dVerified

Name: Heartland Health Center
norm: heartland health center
Domain: heartlandhealthcenter.org

Name: Heartland Health Center
norm: heartland health center
Domain: heartlandhealthcenter.org
Industry: Healthcarellm

Discovered: Feb 4, 2025
Materiality determined: —
Notification sent: Oct 17, 2025
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDFinancial accountCredentialsHealth (basic)PHI
Data elements: Social Security numberDate of birthMedical information
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: External
Regulator citations: Filed notice with Vermont Attorney General

During the incident: Engaged forensic consultants to investigate the root of the incident
Secured its systems
Providing access to Single Bureau Credit Monitoring/Single Bureau Credit Report/Single Bureau Credit Score services at no charge
Providing proactive fraud assistance
Changes made: Continuously upgrading its already robust security measures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 37 weeks(259 days from discovery to filing)
Compliance flags: VT AG >45 bdayLeak >180d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

HHS OCROct 17 · first

Indiana State AGOct 17 · first

Montana State AG+4d

Massachusetts State AG+4d

Vermont State AG+4d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ago.vermont.gov/document/2025-10-21-heartland-health-center-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 21, 2025
Raw hash: 8af1580619d427662edb9fbfe6e90b7606944201d3d64e22bdc190e067c09f8a

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityHeartland Health Center

Victim entityHeartland Health Center

Incidentdiscovered Feb 4, 2025

Stated responseEngaged forensic consultants to investigate the root of the incident

ComplianceVT AG >45 bday

Extraction provenanceno artifact recorded

Source provenanceago.vermont.gov