HackingSupply Chain (3P Vendor)Customer Data InvolvedPHIHEALTH_BASICIDENTITY_BASICLowContained
CareTracker, Inc.
bd_227359edede7100c · schema v1 · pii pii-v1
Full breach record for CareTracker, Inc. →CareTracker, Inc. d/b/a Amazing Charts notified the California AG of a security incident involving a third-party service provider. Unauthorized access to the provider's network occurred between June 15 and June 19, 2025. Affected data may include names, medical treatment/diagnosis info, physician names, medical record numbers, and health insurance information. The company retained legal counsel and cybersecurity specialists, secured the environment, and offered 12 months of credit monitoring.
California clockDiscovered Jun 19, 2025 → Notified Nov 12, 2025146d ✗ CA 60-day late21 weeks discovery → filing
Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-614140
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Nov 12, 2025
- Raw hash
- 2ef5292bac381ae317648c7743b215dba9ab60014e38e14947343b94bc8b8536
Reporting entity
- Name
- CareTracker, Inc.norm: caretracker
Victim entity
- Name
- CareTracker, Inc.norm: caretracker
Incident
- Discovered
- Jun 19, 2025
- Materiality determined
- —
- Notification sent
- Nov 12, 2025
- Affected individuals
- Not disclosed
- Data types
- PHIHEALTH_BASICIDENTITY_BASIC
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1195 Supply Chain Compromise
- Threat actor
- External
- Third party
- via Third-party service provider
- Initial access
- supply_chain
Compliance
- Time to disclose
- 21 weeks(146 days from discovery to filing)
- Compliance flags
- CA 60-day late · 146d
- Discovery-date grounding
- letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Jun 19, 2025→ Notified: Nov 12, 2025146d 60 days (analyst band, pre-2026 discoveries) CA 60-day late
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.