AccidentalHealthcareHealthcareMisdeliveryCustomer Data InvolvedSupply Chain (3P Vendor)Government IDIdentity (basic)MediumResolved

GILEAD SCIENCES, INC.

bd_1aded82ca327dbab · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 18, 2025

Filed

Apr 2, 2025

To disclose

6 weeks

Affected

Not disclosed

Linked

5 filings

Confidence

65%

Full breach record for GILEAD SCIENCES, INC. →2 incidents on file

Gilead Sciences, Inc. notified the California Attorney General of a data breach involving its mailing vendor, Billing Document Specialists (BDS). On February 7, 2025, BDS inadvertently mailed 1095-C tax forms with shipping labels containing visible personal information, including Social Security numbers, through envelope windows. Trusaic, which assists Gilead with ACA compliance, discovered the incident on February 18, 2025. No database intrusions occurred. Affected individuals are offered 24 months of Equifax Credit Watch Gold.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 11 days

discovery → filing · 6 weeks / 43 days

Feb 7, 2025

Begins

Feb 18, 2025

Discovered

Apr 2, 2025

Filed

vs. sector median

6 wks faster

This filing is one of 5 about the same incident.View merged incident

Part of Billing Document Specialists supply-chain incident (2025) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Indiana State AGbd_51cb736a09bb847d2025-04-02Verified
HHS OCRbd_62601c63fa842b762025-04-02Verified
Massachusetts State AGbd_8127a6bb544cf3682025-04-02Verified
Maine State AGbd_bea1e4d72777aec22025-04-02Verified

Name: GILEAD SCIENCES, INC.
norm: gilead sciences
Domain: gilead.com

Name: GILEAD SCIENCES, INC.
norm: gilead sciences
Domain: gilead.com
Industry: Healthcarellm

Discovered: Feb 18, 2025
Breach occurred: Feb 7, 2025
Undetected for: 11 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Government IDIdentity (basic)
Data elements: Social Security number
Attack vector: Unknown
Third party: via Billing Document Specialists

During the incident: Performed a comprehensive technical and operational review
Confirmed that there were not any intrusions to secure, encrypted customer databases or internal servers
Implemented enhanced precautionary technical controls in coordination with BDS
Providing you a complimentary 24-month membership in Equifax Credit Watch Gold
Set up a dedicated and confidential toll-free response line
Changes made: Implemented enhanced precautionary technical controls in coordination with BDS to prevent an incident like this from happening in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(43 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 4 states

View merged incident ↗

Indiana State AGApr 2 · first

HHS OCRApr 2 · first

Massachusetts State AGApr 2 · first

Maine State AGApr 2 · first

California State AGApr 2 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-600828
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 2, 2025
Raw hash: a7c6773063102793aae21b93ac41d90f5bdefc0c7c513fb9fea205b695057a9e

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityGILEAD SCIENCES, INC.

Victim entityGILEAD SCIENCES, INC.

Incidentdiscovered Feb 18, 2025

Stated responsePerformed a comprehensive technical and operational review

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov