Social EngineeringHealthcareFinancial ServicesHealthcarePhishingCustomer Data InvolvedDelayed DiscoveryPHIHealth (basic)Identity (basic)LowContained

Academic HealthPlans, Inc.

bd_0f41ff8620a51b5d · schema v1 · pii pii-v1

Severity

Low

Discovered

Aug 6, 2020

Filed

Aug 13, 2021

To disclose

12 months

Affected

Not disclosed

Linked

5 filings

Confidence

65%

Full breach record for Academic HealthPlans, Inc. →4 incidents on file

Academic HealthPlans, Inc. (AHP), an insurance broker for the University of California, experienced an email phishing incident targeting employees. Unauthorized access occurred in two employees' Microsoft Office 365 email accounts between August 6, 2020, and August 24, 2020, and on October 2, 2020. The incident involved protected health information (PHI) and basic identity data (names). AHP notified the University of California on July 7, 2021, and is providing one year of identity monitoring via Kroll. No evidence of data exfiltration or misuse was found, but the possibility could not be ruled out.

J jump to incidentP pin to compareR raw source

California clockDiscovered Aug 6, 2020 → Notified Jul 7, 2021335d ✗ CA 60-day late12 months discovery → filing

Incident timeline

discovery → filing · 12 months / 372 days

Aug 6, 2020

Begins

Aug 6, 2020

Discovered

Aug 13, 2021

Filed

vs. sector median

+42 wks slower

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Indiana State AGbd_4aa6be7e8157dac52021-08-16 · +3dVerified
Oregon State AGbd_94ceac546db7adb12021-08-02 · +11dVerified
HHS OCRbd_2f539e93b34ab83a2021-07-21 · +23dVerified
Massachusetts State AGbd_f91db733e11627162021-07-20 · +24dVerified

Name: Academic HealthPlans, Inc.
norm: academic healthplans

Name: Academic HealthPlans, Inc.
norm: academic healthplans
Industry: HealthcarellmFinancial Servicesllm

Discovered: Aug 6, 2020
Breach occurred: Aug 6, 2020 – Oct 2, 2020
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 7, 2021
Affected individuals: Not disclosed
Data types: PHIHealth (basic)Identity (basic)
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1114 Email Collection
Threat actor: External
Initial access: phishing_link

During the incident: Notified the University of California of an email phishing incident
Reviewed, both programmatically and manually, the information contained in the employees’ email accounts
Provided extensive training to our employees regarding phishing emails and other cybersecurity issues
Enhanced existing security measures
Secured the services of Kroll to provide identity monitoring at no cost to you for one year
Changes made: Provided extensive training to our employees regarding phishing emails and other cybersecurity issues
Enhanced existing security measures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 12 months(372 days from discovery to filing)
Compliance flags: CA 60-day late · 335d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Aug 6, 2020
→ Notified: Jul 7, 2021
335d 60 days (analyst band, pre-2026 discoveries) CA 60-day late

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Aug 6, 2020 → Notified: Jul 7, 2021	335d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Massachusetts State AGJul 20 · first

HHS OCR+1d

Oregon State AG+13d

California State AG+24d · this page

Indiana State AG+27d

Pattern: first filing Jul 20 (MA), last Aug 16 (IN) — a 27-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-543878
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 13, 2021
Raw hash: 4c4e1b6772f5835919c8bdf70e5858a1d2c44e72e0782e65f018d783aca949e0

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityAcademic HealthPlans, Inc.

Victim entityAcademic HealthPlans, Inc.

Incidentdiscovered Aug 6, 2020

Stated responseNotified the University of California of an email phishing incident

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov