CALIFORNIAHackingHealthcareHealthcareStolen CredentialsPhishingCustomer Data InvolvedData ExfiltratedPHIHealth (basic)Identity (basic)Government IDHighResolved

INOGEN, INC.

bd_18bf03ad63467566 · schema v1 · pii pii-v1

Severity

High

Discovered

Mar 14, 2018

Filed

Apr 17, 2018

To disclose

5 weeks

Affected

29,528

Linked

7 filings

Confidence

67%

Full breach record for INOGEN, INC. →

Inogen, Inc. reported to HHS on 2018-04-17 a Hacking/IT Incident affecting 29,528 individuals. Breached information located on Email. An unauthorized individual gained access to an employee email account and set up forwarding of messages from Jan 2, 2018 to Mar 14, 2018. Compromised PHI included names, addresses, DOBs, Medicare IDs, and medical equipment info. Inogen strengthened security controls including disabling email forwarding, password resets, and implementing dual-factor authentication.

J jump to incidentP pin to compareR raw source

HIPAA clockDiscovered Mar 14, 2018 → Notified Apr 17, 201834d ✓ HHS report on time5 weeks discovery → filing

Incident timeline

undetected · 71 days

discovery → filing · 5 weeks / 34 days

Jan 2, 2018

Begins

Mar 14, 2018

Discovered

Apr 17, 2018

Filed

vs. sector median

4 wks faster

This filing is one of 7 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

New Hampshire State AGbd_5913eb0d6657b7c92018-04-13 · +4dVerified
Oregon State AGbd_a3772efe9f56a94e2018-04-13 · +4dVerified
Montana State AGbd_a6a9be25c11a86922018-04-13 · +4dVerified
Massachusetts State AGbd_b07a5f4b5f221bc42018-04-13 · +4dVerified

Show 2 more filings ↓up to 4d gap

California State AGbd_d3827126424f382b2018-04-13 · +4dVerified
Washington State AGbd_e0b3af7103bb31b22018-04-13 · +4dVerified

Name: INOGEN, INC.
norm: inogen
Industry: Health Care Services

Name: INOGEN, INC.
norm: inogen
Industry: Healthcaresource default

Discovered: Mar 14, 2018
Breach occurred: Jan 2, 2018 – Mar 14, 2018
Undetected for: 71 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 17, 2018
Affected individuals: 29,528nationwide
Data types: PHIHealth (basic)Identity (basic)Government ID
HHS breach type: Hacking / IT incident
Where the data lived: Email
Covered-entity type: Healthcare provider
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: External
Regulator citations: Notified HHSOCR obtained assurances that the CE implemented the corrective action steps
Initial access: valid_credentials

During the incident: Provided breach notification to affected individuals, the media, and HHS
Strengthened security controls by disabling the ability of email users to set forwarding rules
Required all email users and administrators to change their passwords
Implemented dual-factor authentication for remote email access
Changes made: Disabled the ability of email users to set forwarding rules
Required all email users and administrators to change their passwords
Implemented dual-factor authentication for remote email access
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(34 days from discovery to filing)
Compliance flags: HHS report on time · 34dHHS notified
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: Mar 14, 2018
→ Notified: Apr 17, 2018
34d 60 days HHS report on time
HIPAA
Discovered: Mar 14, 2018
→ Notified: Apr 17, 2018
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: Mar 14, 2018 → Notified: Apr 17, 2018	34d	60 days	HHS report on time
HIPAA	Discovered: Mar 14, 2018 → Notified: Apr 17, 2018	—	regulatory submission	HHS notified

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 6 states

View merged incident ↗

New Hampshire State AGApr 13 · first

Oregon State AGApr 13 · first

Montana State AGApr 13 · first

Massachusetts State AGApr 13 · first

California State AGApr 13 · first

Washington State AGApr 13 · first

HHS OCR+4d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Apr 17, 2018
Raw hash: 290e9291fcd627aa07fd041b20f3afe3814dd3555cf3b01b02a6347b2e5c582f

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html2.0 KB

Download View at source

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityINOGEN, INC.

Victim entityINOGEN, INC.

Incidentdiscovered Mar 14, 2018

Stated responseProvided breach notification to affected individuals, the media, and HHS

ComplianceHHS report on time

Extraction provenanceno artifact recorded

Source provenanceocrportal.hhs.gov

Source filing