AccidentalLossCustomer Data InvolvedEmployee Data InvolvedIDENTITY_BASICIDENTITY_GOVERNMENTHEALTH_BASICMediumActive
CareMeridian, LLC
bd_0944bf9bbe2ce4b9 · schema v1 · pii pii-v1
Full breach record for CareMeridian, LLC →CareMeridian, LLC reported a data event in California involving the loss of an unencrypted disk sent by a third-party software provider. The disk contained protected personal information, including names and medical information for 953 California residents, and names and Social Security numbers for 13 residents. CareMeridian retained forensic experts, ceased business with the provider, and offered credit monitoring to affected individuals.
California clockDiscovered Dec 21, 2017 → Notified Mar 20, 201889d ✗ CA 60-day late13 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
This filing is one of 2 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (1) · sorted by filing gap
- bd_0ed8c4a9b105ca17HHS OCRfiled 2018-03-21(1d gap)Verified
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-134637
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Mar 20, 2018
- Raw hash
- a6ab7205681996fd7d6a6db2c49c94b38b2cde2474642a8d86b5f844c154b7f5
Reporting entity
- Name
- CareMeridian, LLCnorm: caremeridian
Victim entity
- Name
- CareMeridian, LLCnorm: caremeridian
Incident
- Discovered
- Dec 21, 2017
- Materiality determined
- —
- Notification sent
- Mar 20, 2018
- Affected individuals
- 953
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENTHEALTH_BASIC
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1052 Exfiltration Over Physical Medium
- Regulator citations
- Notified the California Department of Public HealthNotifying the U.S. Department of Health and Human Services
- Third party
- via Bullpen Financial, Inc.
- Initial access
- removable_media
Compliance
- Time to disclose
- 13 weeks(89 days from discovery to filing)
- Compliance flags
- CA 60-day late · 89d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Dec 21, 2017→ Notified: Mar 20, 201889d 60 days (analyst band, pre-2026 discoveries) CA 60-day late
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.