Advarra Holdings, Inc.

Advarra, a service provider for Moffitt Cancer Center, experienced a data breach on October 25, 2023, when an unauthorized third party accessed a single employee account. The incident was discovered on October 26, 2023. The breach involved the acquisition of limited data, including names of patients and research study participants. Advarra contained the incident, engaged cybersecurity experts, and notified law enforcement. Identity monitoring services were offered to affected individuals.

Advarra, Inc. reported to HHS on 2024-04-19 a Hacking/IT Incident affecting 596 individuals. Breached information located on Email. The business associate experienced a hacking attack of an employee's email account which compromised the protected health information (PHI) of 596 individuals. The PHI involved included names, dates of birth, addresses, Social Security numbers, financial information, and treatment information. The BA notified HHS, the affected individuals, the media, and provided substitute notice. In response to the breach, the BA provided complimentary credit monitoring and implemented additional administrative, technical, and security safeguards. Staff were retrained to better protect sensitive data.

Advarra, Inc. reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2024-02-23. 121 Massachusetts residents were affected.

Advarra, Inc. notified the NH Attorney General of a cybersecurity incident where an unauthorized third party accessed an employee account via SIM swapping on Oct 25, 2023. The attacker exfiltrated HR data, including PII of approximately 7 NH residents. Advarra contained the incident on Oct 26, 2023, engaged forensic experts, notified law enforcement, and provided credit monitoring. SMS MFA was disabled as a remediation measure.

Advarra, Inc. reported a credential compromise/unauthorized access incident occurring October 25-26, 2023, discovered November 5, 2023. The breach affected 4,656 individuals nationwide, including 11 Maine residents. Data acquired included Social Security Numbers and personal identifiers. Advarra, a healthcare organization, provided 24 months of credit monitoring and identity restoration services through Kroll. This filing serves as a supplemental notice to the Maine Attorney General.

Advarra, Inc. reported unauthorized access to a single employee's account in Washington. Access occurred Oct 25-26, 2023. Advarra discovered the incident on Oct 26, 2023, disabled the account, and engaged cybersecurity experts. Affected data included names and SSNs. 1,066 Washington residents were notified. Incident status is contained.

Advarra, Inc. notified Montana residents of a security incident where an unauthorized third party accessed a single employee's account starting October 25, 2023. The attacker downloaded names and Social Security numbers. Advarra disabled the account, launched an investigation, engaged cybersecurity experts, and provided 24 months of credit monitoring.

Advarra, Inc. reported a data breach affecting 1,782 individuals, including 5 Maine residents. The breach, which occurred between October 25 and October 26, 2023, involved unauthorized access to their systems due to a credential compromise. The compromised information includes names and Social Security numbers. The company discovered the breach on November 5, 2023, and began notifying affected individuals on November 29, 2023. Advarra is offering 24 months of credit monitoring and identity restoration services through Kroll.