HackingCustomer Data InvolvedPHIHEALTH_BASICIDENTITY_BASICLowContained
City Health, a medical corporation
bd_24fb6fc18630a86d · schema v1 · pii pii-v1
Full breach record for City Health, a medical corporation →City Health, a medical corporation, reported unauthorized access to patient health information occurring between March 2 and March 11, 2026, discovered on March 30, 2026. Affected data included names, insurance company names, and procedure codes. SSNs, DOBs, and contact info were not involved. The company secured systems, engaged experts, and is reviewing policies.
California clockDiscovered Mar 30, 2026 → Notified Apr 13, 202614d ✓ CA 30-day OK15 days discovery → filing
This filing is one of 2 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (1) · sorted by filing gap
- bd_da428cc32525bd70HHS OCRfiled 2026-04-14Candidate
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-621745
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Apr 14, 2026
- Raw hash
- 7ad6e6fd71752db49e1c790da4d40803dac847a67ddc6172a40df25a6ce353a4
Reporting entity
- Name
- City Health, a medical corporationnorm: city health a medical
- Domain
- cityhealth.com
Victim entity
- Name
- City Health, a medical corporationnorm: city health a medical
- Domain
- cityhealth.com
Incident
- Discovered
- Mar 30, 2026
- Materiality determined
- —
- Notification sent
- Apr 13, 2026
- Affected individuals
- Not disclosed
- Data types
- PHIHEALTH_BASICIDENTITY_BASIC
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1078 Valid Accounts
- Threat actor
- External
- Regulator citations
- Self-reporting this incident to the appropriate authorities
Compliance
- Time to disclose
- 15 days(15 days from discovery to filing)
- Compliance flags
- CA 30-day OK · 14dCA AG copy ≤15d · 1d
- Discovery-date grounding
- letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Mar 30, 2026→ Notified: Apr 13, 202614d 30 calendar days CA 30-day OK California Consumers notified: Apr 13, 2026→ AG copy submitted: Apr 14, 20261d 15 calendar days CA AG copy ≤15d
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.