AccidentalHealthcareTechnologyHealthcareMisconfigurationMisdeliveryCustomer Data InvolvedPHIHealth (basic)LocationMetadataLowResolved

Insulet Corporation

bd_09375a81f3d038e8 · schema v1 · pii pii-v1

Severity

Low

Discovered

Dec 6, 2022

Filed

Jan 10, 2023

To disclose

5 weeks

Affected

Not disclosed

Linked

6 filings

Confidence

64%

Full breach record for Insulet Corporation →8 incidents on file

Insulet Corporation disclosed a data privacy incident involving the exposure of limited protected health information (PHI) for Omnipod DASH customers. Due to a misconfiguration of web pages used for receipt verification of a Medical Device Correction letter, customer IP addresses, product usage status, and Personal Diabetes Manager usage were exposed to website performance and marketing partners via cookies and trackers. The incident occurred on December 1, 2022, and was discovered on December 6, 2022. Insulet disabled tracking codes and requested partner log deletion. No financial information, SSNs, emails, or passwords were exposed.

J jump to incidentP pin to compareR raw source

California clockDiscovered Dec 6, 2022 → Notified Jan 5, 202330d ✓ CA 60-day OK5 weeks discovery → filing

Incident timeline

undetected · 5 days

discovery → filing · 5 weeks / 35 days

Dec 1, 2022

Begins

Dec 6, 2022

Discovered

Jan 10, 2023

Filed

vs. sector median

4 wks faster

This filing is one of 6 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Montana State AGbd_b72b9465f971309e2023-01-09 · +1dVerified
HHS OCRbd_2cb545435cd825282023-01-05 · +5dVerified
Delaware State AGbd_4b77c0e779b47ea32023-01-05 · +5dVerified
Washington State AGbd_ac854debf0ab0ad92023-01-05 · +5dVerified

Show 1 more filing ↓up to 9d gap

Illinois State AGbd_4e14c83bbb87dd602023-01-01 · +9dVerified

Name: Insulet Corporation
norm: insulet
Domain: insulet.com

Name: Insulet Corporation
norm: insulet
Domain: insulet.com
Industry: HealthcarellmTechnologyllm

Discovered: Dec 6, 2022
Breach occurred: Dec 1, 2022 – Dec 6, 2022
Undetected for: 5 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 5, 2023
Affected individuals: Not disclosed
Data types: PHIHealth (basic)LocationMetadata
Attack vector: Misconfiguration
Third party: via Insulet website performance and marketing partners

During the incident: Disabled all tracking codes on the MDC acknowledgment web page
Requesting that partners delete logs of the IP addresses and unique URLs
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(35 days from discovery to filing)
Compliance flags: CA 60-day OK · 30d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Dec 6, 2022
→ Notified: Jan 5, 2023
30d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Dec 6, 2022 → Notified: Jan 5, 2023	30d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Illinois State AGJan 1 · first

HHS OCR+4d

Delaware State AG+4d

Washington State AG+4d

Montana State AG+8d

California State AG+9d · this page

Pattern: first filing Jan 1 (IL), last Jan 10 (CA) — a 9-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-561488
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 10, 2023
Raw hash: 2726dcaaae7995389186d5c03e4b6159a1656504e1b11f4b093f9b094c3a093b

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityInsulet Corporation

Victim entityInsulet Corporation

Incidentdiscovered Dec 6, 2022

Stated responseDisabled all tracking codes on the MDC acknowledgment web page

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov