AccidentalMisconfigurationCustomer Data InvolvedPHIHEALTH_BASICIDENTITY_BASICLowResolved
Wellfleet Group, LLC
bd_13dbd31fe1337ade · schema v1 · pii pii-v1
Full breach record for Wellfleet Group, LLC →Wellfleet Group, LLC experienced a data security incident due to a website misconfiguration that allowed medical referral data (PHI) to be indexed by search engines. The issue was discovered on August 1, 2024, and immediately remediated by disabling the misconfiguration and removing public access. No malicious cyber activity was involved. Affected individuals were offered 24 months of credit monitoring.
California clockDiscovered Aug 1, 2024 → Notified Oct 28, 202488d ✗ CA 60-day late15 weeks discovery → filing
This filing is one of 5 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (4) · sorted by filing gap
- bd_702c49853db45dd8Vermont State AGfiled 2024-10-11(31d gap)Verified
- bd_b3b97e27a29f8c61Montana State AGfiled 2024-10-11(31d gap)Verified
- bd_e802c5df9583d5f0California State AGfiled 2024-10-11(31d gap)Verified
- bd_79666de62511cf32HHS OCRfiled 2024-10-08(34d gap)Verified
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-594721
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Nov 11, 2024
- Raw hash
- f629318ba7db682ba6531361f94c69d6e95dfdfc9a4675b5c04f1ee30bfb9c55
Reporting entity
- Name
- Wellfleet Group, LLCnorm: wellfleet group
Victim entity
- Name
- Wellfleet Group, LLCnorm: wellfleet group
Incident
- Discovered
- Aug 1, 2024
- Materiality determined
- —
- Notification sent
- Oct 28, 2024
- Affected individuals
- Not disclosed
- Data types
- PHIHEALTH_BASICIDENTITY_BASIC
- Attack vector
- Misconfiguration
Compliance
- Time to disclose
- 15 weeks(102 days from discovery to filing)
- Compliance flags
- CA 60-day late · 88d
- Discovery-date grounding
- letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Aug 1, 2024→ Notified: Oct 28, 202488d 60 days (analyst band, pre-2026 discoveries) CA 60-day late
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.