HackingStolen CredentialsSupply Chain (3P Vendor)Customer Data InvolvedDelayed DiscoveryPHIIDENTITY_BASICIDENTITY_GOVERNMENTHEALTH_BASICMediumContained
Santa Cruz Community Health
bd_1c222bd41a241ca7 · schema v1 · pii pii-v1
Full breach record for Santa Cruz Community Health →Santa Cruz Community Health notified patients that a third-party vendor, Trizetto Provider Solutions (TPS), experienced unauthorized access to its website. An unauthorized party accessed health insurance files from November 2024 to October 2025. Affected data includes names, addresses, dates of birth, Social Security numbers, and health insurance numbers. TPS engaged experts and law enforcement, secured the system, and is offering free credit monitoring.
California clockDiscovered Oct 2, 2025 → Notified Dec 12, 202571d ✗ CA 60-day late15 weeks discovery → filing
Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-617249
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jan 16, 2026
- Raw hash
- a5a326fd11857118f5cf997d2d9a4552d82864b0fa909d869220ae35a97c50be
Reporting entity
- Name
- Santa Cruz Community Healthnorm: santa cruz community health
- Domain
- schealthcenters.org
Victim entity
- Name
- Santa Cruz Community Healthnorm: santa cruz community health
- Domain
- schealthcenters.org
Incident
- Discovered
- Oct 2, 2025
- Materiality determined
- —
- Notification sent
- Dec 12, 2025
- Affected individuals
- Not disclosed
- Data types
- PHIIDENTITY_BASICIDENTITY_GOVERNMENTHEALTH_BASIC
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1078 Valid Accounts
- Threat actor
- External
- Third party
- via Trizetto Provider Solutions
- Initial access
- trusted_relationship
Compliance
- Time to disclose
- 15 weeks(106 days from discovery to filing)
- Compliance flags
- CA 60-day late · 71d
- Discovery-date grounding
- letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Oct 2, 2025→ Notified: Dec 12, 202571d 60 days (analyst band, pre-2026 discoveries) CA 60-day late
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.