Chemonics International Discloses Data Breach Affecting Over 263,000 Individuals
Signaux Girod : Déclaration rachat actions propres semaine 48/2024 December 02, 2024 11:40 ET | Source: Signaux Girod Signaux Girod SIGNAUX GIROD Société anonyme au capital de 13 422 500 € Siège social : 881, route des…
Key points
- Disclosure on December 3, 2024.
- Intruders had access to systems from May 2023.
- Over 263,000 individuals affected.
Connected intelligence
Signal brief
Follow the organization, likely method and potential impact to explore connected Shadow Tier intelligence.
Organization
- Published
- Dec 3, 2024
- Updated
- Jul 22, 2026
- Confidence
- High
- Evidence
- 4 sources
Structured assessment
Signal analysis
This analysis groups the signal by industry, likely incident action and impacted security area. It helps compare this signal with other published signals without treating the labels as final determinations.
Threat source
Watch exposure paths that could affect data, operations or third-party trust.
Business impact
- Impact area
- Confidentiality
- Likely asset
- User or customer data
Mentioned entities
Quick context
Questions about this signal
What happened in this signal?
Signaux Girod : Déclaration rachat actions propres semaine 48/2024 December 02, 2024 11:40 ET | Source: Signaux Girod Signaux Girod SIGNAUX GIROD Société anonyme au capital de 13 422 500 € Siège social : 881, route des fontaines 39400 BELLEFONTAINE 646 050 476 R.C.S. LONS-LE-SAUNIER Code ISIN : FR0000060790 DECLARATION Transactions sur actions propres réalisées en novembre 2024 – Semaine 48 En application de l'article 5 du règlement U.E. n°596/2014 du 16 avril 2014 relatif aux abus de marché et du règlement délégué U.E. n°2016/1052 du 8 mars 2016 sur les conditions applicables aux programmes de rachat et aux mesures de stabilisation, SIGNAUX GIROD déclare ci-après les transactions réalisées sur ses propres actions pour la période du 25/11/2024 au 29/11/2024 : Présentation agrégée par jour et par marché Le détail des transactions est disponible sur notre site : www.girod-gr o up.com Signaux Girod - Déclaration rachat d'actions propres S48.2024 July 20, 2026 11:40 ET | Source: Signaux Girod Signaux Girod : Déclaration rachat actions propres semaine 29/2026 SIGNAUX GIROD Société anonyme au capital de 13 422 500 € Siège social : 881, route des fontaines 39400 BELLEFONTAINE 646 050 476 R.C.S. LONS-LE-SAUNIER Code ISIN : FR0000060790 DECLARATION... July 03, 2026 11:40 ET | Source: Signaux Girod Signaux Girod : Publication relative aux actions et droits de vote au 30.06.2026 SIGNAUX GIROD Société anonyme au capital de 13 422 500 € Siège social : 881, route des fontaines 39400 BELLEFONTAINE 646 050 476 R.C.S. LONS-LE-SAUNIER Code ISIN : FR0000060790 DECLARATIONS au titre... Migliaccio & Rathod LLP is involved in the Chemonics International Data Breach Investigation for a data breach that affected 263,136 individuals and their personal information. On December 3, 2023, Chemonics International, Inc. (“Chemonics International”) became aware that an unauthorized party had gained access to its network. Subsequently, Chemonics International conducted an investigation, which uncovered that a cybercriminal had acquired the personally identifiable information of Chemonics International consumers contained therein between May 30, 2023, and January 4, 2024. While it is unclear what specific categories of compromised information was stolen in the data breach, Chemonics International claims the data includes personal information. Chemonics International recently filed notice of the data breach. All of the information stolen is likely valuable and dangerous to affected victims. As is likely to be the case with the Chemonics International data breach, in previous cyberattacks, victims of data theft have noticed identity theft attempts ranging from fraudulent charges on bank accounts or credit cards, to unauthorized credit card applications, to medical services or government services ordered in their name, to their information being posted on the dark web, to a massive uptick in the number of spam text messages, calls and emails received. Are you an Chemonics International consumer concerned that you might be affected by this data breach? If you have concerns that you have been affected by this data breach, and/or have experienced suspicious activity since the data breach, we would like to hear from you. Please complete the contact form on this page, send us an email at [email protected] , or give us a call at (202) 470-3520. The lawyers at Migliaccio & Rathod LLP have years of experience in class action litigation against large corporations, including in cases involving data breaches such as this. More information about our current cases and investigations is available on our blog. Chemonics International Data Breach Notification
When was this signal reported?
Shadow Tier lists Dec 3, 2024 as the signal date.
Which organization is connected to this signal?
Chemonics is the organization connected to this public signal.
Explore ChemonicsWhich impact area is relevant?
This signal is connected to data exposure and breach intelligence based on its reported consequences.
Explore data exposure and breach intelligenceRelated signals
Compare shared topics, actors and incident patterns before opening the full signal.
Qualtrics users impacted by Canvas (Instructure) nationwide data breach
A widespread security incident affecting Canvas, a learning management system by Instructure, impacted thousands of institutions, including Rutgers University, which utilizes the Qualtrics survey tool. Instructure notified Rutgers that while there was no indication of passwords, dates of birth, government identifiers, or financial information being involved, the specific Rutgers data compromised remains unclear. Instructure reportedly reached an agreement with the unauthorized threat actor, and the stolen data was returned and destroyed. Canvas remained operational throughout the incident.
Related context
Suno AI Music Generator Data Leak
A data leak at the AI music generator Suno, which occurred in November 2025, became public in July 2026. The breach exposed data from over 55 million unique email addresses and, for users who registered with their phone numbers, those numbers as well. A small portion of the dataset also included payment processor Stripe data, leading to the leak of names, physical addresses, purchase amounts, and certain credit card details (card type, expiration date, and last four digits) for tens of thousands of users. Suno confirmed it does not have access to full credit card numbers via Stripe.
Related context
SR Bancorp's Internal Audit Provider, Mercadien, Experiences Data Security Incident
Mercadien, P.C. CPAs, an internal audit service provider for SR Bancorp and Somerset Regal Bank, reported a data security incident on July 10, 2026. An unauthorized actor accessed and acquired files from Mercadien's servers containing sensitive customer data belonging to Somerset Regal Bank. The compromised data included customer names, Social Security numbers, account numbers, identification documents, and dates of birth. Importantly, SR Bancorp confirmed that its own business systems, payment systems, customer access to accounts, and core information technology infrastructure were not affected by the incident. The bank is coordinating with Mercadien to provide notifications to affected customers as required by federal and state laws and regulatory guidance. While the incident exposes customers to potential identity theft and fraud, SR Bancorp currently assesses the financial impact as immaterial to its consolidated financial condition or results of operations. This incident highlights the significant risks associated with third-party vendors handling sensitive customer information.
SR Bancorp Discloses Data Security Incident at Internal Audit Provider Mercadien, Exposing Somerset Regal Bank Customer Data
SR Bancorp, Inc. reported a data security incident on July 10, 2026, involving its internal audit service provider, Mercadien, P.C. CPAs. An unauthorized actor accessed and acquired files from Mercadien's servers that contained sensitive customer data belonging to Somerset Regal Bank. The compromised information included customer names, Social Security numbers, account numbers, identification documents, and dates of birth. Importantly, SR Bancorp confirmed that the bank's own business systems, payment systems, customer access to accounts, and core information technology infrastructure were not directly impacted or disrupted by this incident. The company is coordinating customer notifications through Mercadien as required by applicable federal and state laws and regulatory guidance. While the incident exposes SR Bancorp to regulatory notification requirements, reputational risk, and potential legal liability, the company has initially assessed the financial impact as immaterial to its consolidated financial condition or results of operations. However, this assessment could change if the data is published or misused, or if further cybersecurity incidents occur. This event highlights the inherent risks associated with third-party vendors handling sensitive customer information.
Related context
U.S. Insurance Provider AssuranceAmerica Discloses Data Breach Affecting 6.9 Million People
U.S. insurance provider AssuranceAmerica confirmed a data breach affecting the personal information and driver's license numbers of 6.9 million people. The company discovered hackers in its computer systems on March 17, 2026, and concluded its investigation on June 15, 2026, with notification letters scheduled to be sent out on July 10, 2026.
Related context
Xsolis Data Breach Exposes 1.4 Million Patient Records Across Eight Health Systems
A targeted phishing attack on healthcare AI company Xsolis has exposed the data of at least 1.4 million patients across eight U.S. health systems. Xsolis develops utilization management and care coordination technology widely used by hospitals and health systems. This breach now ranks among the most significant healthcare vendor cyberattacks of 2026. The U.S. Department of Health and Human Services (HHS) confirmed the patient impact figure on June 22, after Xsolis filed its breach report on June 5. Moreover, legal action over the incident has already been filed in at least one case, signaling growing accountability pressure on AI vendors handling sensitive patient data. The breach did not begin with the disclosure. Instead, the unauthorized access occurred months earlier. On January 20, 2026, an unidentified actor accessed portions of Xsolis’s IT environment. The attacker then acquired a limited number of files from within the system. Xsolis did not report the incident to HHS until June 5 — roughly four and a half months after the initial intrusion. This delay has drawn scrutiny. Furthermore, Hendrick Health in Abilene, Texas, faced a separate lawsuit specifically citing delayed patient notification as a key concern. Xsolis has stated the company is not currently aware of any misuse of the stolen data. However, the company has declined to specify which types of patient information were exposed. A spokesperson confirmed Xsolis is notifying affected individuals but is not commenting beyond its June 5 public statement. The following health systems have confirmed involvement in the Xsolis data breach : Rochester Regional Health — Rochester, N.Y. Together, these eight organizations collectively serve patients across six states. Consequently, the breach spans a wide geographic footprint — from the Pacific Northwest to the Southeast and Midwest. Xsolis took several steps after discovering the breach . First, the company reported the incident to HHS on June 5. Next, it began notifying affected patients directly. Additionally, Xsolis released a formal public statement through PR Newswire acknowledging the security incident. However, critics note that the five-month gap between the January intrusion and the June disclosure raises serious questions. Under HIPAA, covered entities and business associates generally must report breaches within 60 days of discovery. Health systems and regulators are now examining whether this timeline met legal standards. Why This Breach Matters for Healthcare AI This incident highlights a critical vulnerability in modern healthcare operations. Health systems increasingly rely on third-party AI vendors for functions like utilization management and care coordination. As a result, these vendors hold highly sensitive patient records — making them attractive targets for cybercriminals. Phishing attacks remain the leading method hackers use to gain unauthorized access. Notably, a single successful phishing email at a vendor like Xsolis can cascade into a breach affecting millions of patients at multiple health systems simultaneously. Third-Party Risk in Healthcare Is Growing Third-party vendor breaches now account for a rising share of healthcare data incidents. Therefore, health systems that outsource clinical and operational functions to AI companies must treat vendor cybersecurity as a direct extension of their own risk management. Regulators, including HHS’s Office for Civil Rights, actively scrutinize business associate agreements (BAAs) and breach timelines. Health systems found to lack adequate vendor oversight face fines and reputational harm alongside their vendors. Health system leaders should act quickly when a vendor breach occurs. First, they must verify whether their organization was part of the affected vendor’s client base. Next, they should request a full incident report from the vendor, including the timeline and scope of data access. Additionally, health systems must assess their own HIPAA obligations independently. Even when a vendor like Xsolis handles patient notifications, the covered health system retains compliance responsibility. Going forward, health systems should strengthen third-party risk programs. Key actions include conducting annual security assessments of all AI and health IT vendors, requiring vendors to carry cyber liability insurance, and including clear breach notification timelines in every BAA. Furthermore, phishing awareness training must extend beyond a health system’s own staff. Health systems should require vendors to demonstrate regular employee security training as a contract condition. Ultimately, a vendor’s security posture directly affects every patient record that vendor touches. Vendor breaches, regulatory shifts, and the governance gaps in between. Here's what happened this month in third-party risk management news. Financial institutions are legally accountable for what their vendors do with customer data. Outsourcing a function doesn't outsource the liability that comes with it — a principle that runs through GLBA Safeguards Rule requirements, state privacy laws, and open banking obligations under Part 1033. Vendor contracts need to do more than check a compliance box: they should specify permitted data uses, require breach notification within 24–48 hours, include audit rights, and address AI governance for any vendor using automated decision-making. Fourth-party risk also warrants explicit contract language requiring vendors to disclose and flow down obligations to their own subcontractors. A phishing attack on a healthcare AI vendor exposed 1.4 million patient records. Xsolis, which provides AI-powered utilization management to hospitals and health insurers, was breached through a single phishing email, exposing Social Security numbers, health insurance details, and medical treatment records across seven major hospital systems including Mayo Clinic. At least one organization — Rochester Regional Health — had ended its relationship with Xsolis in 2021, yet its patient data was still in scope at the time of the breach. Most of the 1.4 million affected had no idea the vendor held their information at all. Third-party vendor incidents now account for 58% of all healthcare data breaches, and this case is a concrete reminder that data deletion at offboarding is a risk control, not an administrative afterthought. The Klue breach reached LastPass customer data. Attackers used OAuth tokens stolen from Klue to access LastPass's Salesforce environment, exposing customer names, contact details, and support case records. Password vaults were unaffected, but the stolen data is enough to fuel targeted phishing. Fourth-party risk in practice: a vendor relationship several steps removed still produced direct customer harm. How to Avoid Common Third-Party Risk Management Mistakes
Related context