Confirmed breach. Intrusion Aug 20, 2024–Aug 25, 2024, discovered Aug 26, 2024 — the first regulatory filing landed 60 days later (flagged late). 23,205 individuals reported across the linked filings.
Discovery variance · Leak precedence · Materiality delta · SEC filing delay — no leak-site claim in this cluster; no SEC 8-K in this cluster; needs two dated filings.
Regulatory clocksVermont✗ VT AG >45 bdayHIPAA✓ HHS notifiedFull clock table in Litigation Timeline
HHS OCRState AGConfirmedLifecycle stage 2 of 3: ConfirmedUnverified claimConfirmedEnforced
Affected (total reported)
23,205
Data types
—
Jurisdictions
4
HI IN MT VT
Linked filings
4
HHS OCR · State AG
Timeline
Earliest sighting first · deep chronology in Litigation Timeline
Breach window
Aug 20, 2024
When the intrusion reportedly occurred, per the linked filings
Breach discovered
Aug 26, 2024
Reported by VERMONT AG filing
60 days
🏎️Indiana State AGFirst filinglinked via multistate filing link · 95%
Hawaii Radiologic Associates Ltd reported a data breach to the Indiana Attorney General. The breach occurred on 2024-08-20 and was reported on 2024-10-25. 6 Indiana residents were affected. 22,915 individuals affected in total.
Affected (this filing): 22,915
🌺HAWAIIHHS OCRlinked via same-victim cross-source · 100%
Hawaii Radiologic Associates, Ltd. reported to HHS on 2024-10-25 a Hacking/IT Incident affecting 23205 individuals. Breached information located on Network Server.
Affected (this filing): 23,205
HHS notified
🦬Montana State AGlinked via same-victim cross-source · 100%
Hawaii Radiological Associates, Ltd. reported a data breach to the Montana Attorney General. The breach was reported on 2024-11-05. The breach occurred from 8/20/2024 to 8/25/2024. 10 Montana residents were affected.
Affected (this filing): 10
🍁Vermont State AGMost recentlinked via same-victim cross-source · 100%
Hawaii Radiologic Associates, Ltd. notified consumers of a security incident where an unknown actor gained unauthorized access to systems between August 20-25, 2024. Suspicious activity was detected on August 26, 2024. Impacted data included names, dates of birth, health insurance subscriber IDs, and exam details. No evidence of misuse was found. The company reported the incident to federal law enforcement and is reviewing security protocols.
About this clustering
DisclosureLens links filings into incidents through layered matchers: deterministic rules (same source document, multistate filings of one breach, tight-window same-victim pairs), a weighted-similarity scorer for cross-source candidates, and an operator review queue for everything uncertain. Each link records its own method and confidence — shown per filing in the timeline below. The system defaults to NOT merging when uncertain, because a false merge (collapsing two unrelated breaches) is more harmful than a false split (showing related filings separately); uncertain pairs route to human review instead of auto-merging. Filing summaries shown in the timeline are AI-generated extracts — verify each against its linked source.