AccidentalMisdeliveryData ExfiltratedCustomer Data InvolvedSupply Chain (3P Vendor)PHIHEALTH_BASICIDENTITY_BASICIDENTITY_GOVERNMENTMediumContained
Universal Care, Inc.
bd_0a6e40c5986753bb · schema v1 · pii pii-v1
Full breach record for Universal Care, Inc. →Universal Care DBA Brand New Day experienced a data breach on December 22, 2016, where a third-party vendor system allowed unauthorized access to members' protected health information (PHI), including names, DOBs, Medicare IDs, addresses, and phone numbers. The breach was discovered on December 28, 2016. The vendor corrected the error within hours. The company notified the California AG and HHS, conducted a self-audit, and implemented monthly user verification. Affected individuals received 12 months of identity theft monitoring via Experian.
Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-66713
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Mar 3, 2017
- Raw hash
- 397767afe2b6235df4d27d2468bca998e14b45ad99c9b63b31658447cae34e90
Reporting entity
- Name
- Universal Care, Inc.norm: universal care
Victim entity
- Name
- Universal Care, Inc.norm: universal care
Incident
- Discovered
- Dec 28, 2016
- Materiality determined
- —
- Notification sent
- —
- Affected individuals
- Not disclosed
- Data types
- PHIHEALTH_BASICIDENTITY_BASICIDENTITY_GOVERNMENT
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1195 Supply Chain Compromise
- Threat actor
- Partner
- Regulator citations
- reported this breach to the California Office of the Attorney Generalreported it to the United States Department of Health & Human Services
- Initial access
- supply_chain
Compliance
- Time to disclose
- 9 weeks(65 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.