3.8 Million People. Almost a Year Before They Knew.
Healthcare software company Unlimited Technology Systems disclosed a breach affecting 3.8 million people. The incident occurred back in October 2025, but the scale only came to light recently.
Sit with that gap for a second. Nearly a year passed between the breach happening and the full scope becoming public. For 3.8 million people, that means nearly a year where their information may have been exposed without them knowing it, unable to watch their accounts, freeze their credit, or take any of the steps people normally take once they know they are at risk.
A breach is a bad day. A breach that takes almost a year to fully disclose is a bad year, and the two are not the same category of problem. The initial incident is often a matter of what happened. The disclosure timeline is a matter of what the company chose to do, and how quickly, once it had at least some understanding that something had gone wrong. This matters especially in healthcare, where the data involved carries a different kind of sensitivity and a longer shelf life for misuse than something like a credit card number.
A slow disclosure timeline does not just delay bad news, it compounds the consequences once the news does arrive. Regulators tend to scrutinize the gap between discovery and disclosure as closely as the breach itself, and a company whose full scope only becomes clear after nearly a year invites a harder question than the breach alone would have.
Three things worth doing this week:
Build a realistic incident disclosure timeline before you need one. Know your notification obligations in advance, so the clock isn't the first thing your team figures out under pressure.
Treat investigation speed as part of your security posture, not a separate legal matter. The faster you can determine actual scope, the faster you can meet your obligations.
Communicate proactively even when the full picture isn't complete. An honest "investigation is ongoing" update tends to land better than silence followed by one delayed, complete disclosure.
Do this today. Check whether your incident response plan includes an actual communication timeline, not just a technical cleanup checklist.