HackingHealthcareHealthcareData ExfiltratedCustomer Data InvolvedPIIIdentity (basic)Government IDMediumResolved

Octapharma Plasma, Inc.

bd_10c15797aebfb891 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 17, 2024

Filed

Sep 19, 2024

To disclose

22 weeks

Affected

Not disclosed

Linked

9 records

Confidence

64%

Full breach record for Octapharma Plasma, Inc. →

On April 17, 2024, Octapharma Plasma, Inc. detected suspicious activity on its IT systems. An unauthorized party accessed file share systems and acquired personal information. The incident has been contained and the investigation concluded. Affected individuals were offered 24 months of credit monitoring.

J jump to incidentP pin to compareR raw source

California clockDiscovered Apr 17, 2024 → Notified Aug 30, 2024135d ✗ CA 60-day late22 weeks discovery → filing

Incident timeline

discovery → filing · 22 weeks / 155 days

Apr 17, 2024

Begins

Apr 17, 2024

Discovered

Sep 19, 2024

Filed

vs. sector median

+13 wks slower

This filing is one of 9 records about the same incident.View merged incident

A leak claim by blacksuit about this victim was first seen 149 days before this filing.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Siteblacksuitbd_580edc4845b6f56c2024-04-15 · +157dVerified by operator

Regulatory filings (6) · sorted by filing gap

Massachusetts State AGbd_0d6a42ef1e1214a32024-09-20 · +1dVerified
South Carolina State AGbd_90afedd7ea903d802024-09-20 · +1dVerified
Oregon State AGbd_eddf2253a2b1ce3e2024-09-15 · +4dVerified
Indiana State AGbd_9e046345d8d63c4d2024-08-30 · +20dVerified

Show 2 more filings ↓up to 49d gap

Washington State AGbd_9e19a3be7beab16f2024-08-30 · +20dVerified
Illinois State AGbd_2ee8dd80fea628e32024-08-01 · +49dCandidate

Press reports (1)

Pressblacksuitbd_b79d0cb85c75fedf2024-04-15 · +157dCandidate

Name: Octapharma Plasma, Inc.
norm: octapharma plasma
Domain: octapharmaplasma.com

Name: Octapharma Plasma, Inc.
norm: octapharma plasma
Domain: octapharmaplasma.com
Industry: Healthcarellm

Discovered: Apr 17, 2024
Breach occurred: Apr 17, 2024
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 30, 2024
Affected individuals: Not disclosed
Data types: PIIIdentity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: External
Regulator citations: Notified the FBI

During the incident: Took prompt action to respond to this incident
Launched an investigation with the assistance of third-party cybersecurity experts and the FBI
Took steps to secure the systems and contain the incident
Arranged for 24 months of credit monitoring services from IDX
Changes made: Working to further strengthen its security controls
Undertaking a review of technical security safeguards
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 22 weeks(155 days from discovery to filing)
Compliance flags: CA 60-day late · 135dLeak >90d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Apr 17, 2024
→ Notified: Aug 30, 2024
135d 60 days (analyst band, pre-2026 discoveries) CA 60-day late

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Apr 17, 2024 → Notified: Aug 30, 2024	135d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 7 states

View merged incident ↗

Illinois State AGAug 1 · first

Indiana State AG+29d

Washington State AG+29d

Oregon State AG+45d

California State AG+49d · this page

Massachusetts State AG+50d

South Carolina State AG+50d

Pattern: first filing Aug 1 (IL), last Sep 20 (SC) — a 50-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-592123
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 19, 2024
Raw hash: aefa5be45bb33c3875677b8117e065a6c2ef88b3e5fc158744bfc9f42f655d50

Linked disclosures

Ransomware claims (1)

Regulatory filings (6) · sorted by filing gap

Press reports (1)

Reporting entityOctapharma Plasma, Inc.

Victim entityOctapharma Plasma, Inc.

Incidentdiscovered Apr 17, 2024

Stated responseTook prompt action to respond to this incident

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov