MalwareHealthcareHealthcareInfostealerCustomer Data InvolvedDelayed DiscoveryPHIGovernment IDIdentity (basic)Health (basic)MediumActive

Reeve-Woods Eye Center

bd_22a2ddc8c98ad3dc · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 17, 2014

Filed

Nov 14, 2014

To disclose

8 weeks

Affected

Not disclosed

Linked

2 filings

Confidence

65%

Full breach record for Reeve-Woods Eye Center →

Reeve-Woods Eye Center discovered malware on its servers on September 17, 2014, which had been capturing screenshots containing patients' protected health information, including SSNs and medical history, since approximately August 2014. The malware was removed, and law enforcement was notified. The investigation was ongoing at the time of the November 12, 2014 notification.

J jump to incidentP pin to compareR raw source

California clockDiscovered Sep 17, 2014 → Notified Nov 12, 201456d ✓ CA 60-day OK8 weeks discovery → filing

Incident timeline

undetected · 47 days

discovery → filing · 8 weeks / 58 days

Aug 1, 2014

Begins

Sep 17, 2014

Discovered

Nov 14, 2014

Filed

vs. sector median

3 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

HHS OCRbd_299d3c24ce7f01b22014-11-15 · +1dVerified by operator

Name: Reeve-Woods Eye Center
norm: reeve woods eye center

Name: Reeve-Woods Eye Center
norm: reeve woods eye center
Industry: Healthcarellm

Discovered: Sep 17, 2014
Breach occurred: Aug 1, 2014 – Aug 31, 2014
Undetected for: 47 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 12, 2014
Affected individuals: Not disclosed
Data types: PHIGovernment IDIdentity (basic)Health (basic)
Data elements: Social Security numberDate of birthMedical information
Attack vector: Unknown
MITRE ATT&CK: T1056 Input Capture
Threat actor: External
Regulator citations: Notified federal law enforcement

During the incident: Removed malware from computers
Heightened computer system security
Provided additional training to staff concerning the protection of patient information
Notified federal law enforcement
Changes made: Heightened computer system security
Provided additional training to staff concerning the protection of patient information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(58 days from discovery to filing)
Compliance flags: CA 60-day OK · 56d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Sep 17, 2014
→ Notified: Nov 12, 2014
56d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Sep 17, 2014 → Notified: Nov 12, 2014	56d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings

View merged incident ↗

California State AGNov 14 · first · this page

HHS OCR+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-47505
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 14, 2014
Raw hash: 0ab826d23eeb3f8394ed7e613f6ebf8a541369efb7905e81030f78c8592dd456

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityReeve-Woods Eye Center

Victim entityReeve-Woods Eye Center

Incidentdiscovered Sep 17, 2014

Stated responseRemoved malware from computers

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov