MalwareHealthcareHealthcareRansomwareSupply Chain (3P Vendor)Customer Data InvolvedData EncryptedPHIIdentity (basic)LowContained

Compton Eyecare Optometry, Inc.

bd_1813cb18f424be53 · schema v1 · pii pii-v1

Severity

Low

Discovered

Nov 3, 2021

Filed

Feb 28, 2022

To disclose

17 weeks

Affected

Not disclosed

Confidence

65%

Full breach record for Compton Eyecare Optometry, Inc. →

Compton Eye Care Optometry notified the California AG of a ransomware attack on its cloud provider, DataHEALTH, Inc., on November 3, 2021. The attacker accessed data via a third-party software vulnerability. Personal information, including names and potentially PHI, was compromised. DataHEALTH contained the incident, engaged forensics, notified the FBI, and offered one year of identity monitoring via Kroll.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 17 weeks / 117 days

Nov 3, 2021

Begins

Nov 3, 2021

Discovered

Feb 28, 2022

Filed

vs. sector median

+4 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: Compton Eyecare Optometry, Inc.
norm: compton eyecare optometry
Domain: comptoneyecare.com

Name: Compton Eyecare Optometry, Inc.
norm: compton eyecare optometry
Domain: comptoneyecare.com
Industry: Healthcarellm

Discovered: Nov 3, 2021
Breach occurred: Nov 3, 2021
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: PHIIdentity (basic)
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1195 Supply Chain Compromise
Threat actor: ExternalFinancial
Regulator citations: Reported to the FBI
Third party: via DataHEALTH, Inc.
Initial access: supply_chain

During the incident: Took measures to contain the incident
Launched an investigation
Engaged third-party cybersecurity forensic experts
Reported this information to the FBI
Cooperating with the FBI in its investigation
Worked with the third-party software provider to update log-in credentials for all DataHEALTH customers that utilize the software
Secured the services of Kroll to provide identity monitoring at no cost for one year
Changes made: Implemented additional security protocols designed to enhance the security of DataHEALTH’s network, internal systems and applications
Continuing to evaluate additional steps that may be taken to further increase defenses
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 17 weeks(117 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-551300
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 28, 2022
Raw hash: 42d1afcb51499c94a2d5dc4ac8bf7c9fc3223bdf6ed3964be69dc6f6f8839b59

Reporting entityCompton Eyecare Optometry, Inc.

Victim entityCompton Eyecare Optometry, Inc.

Incidentdiscovered Nov 3, 2021

Stated responseTook measures to contain the incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov