HackingData ExfiltratedCustomer Data InvolvedPHIIDENTITY_BASICIDENTITY_GOVERNMENTHEALTH_BASICFINANCIAL_ACCOUNTMediumContained
EpiSource
bd_26b46fb137569987 · schema v1 · pii pii-v1
Full breach record for EpiSource →Episource, LLC disclosed a data breach where a criminal accessed and copied data between January 27, 2025, and February 6, 2025. The incident was discovered on February 6, 2025. Affected data includes contact information, health insurance data, health data (diagnoses, treatments), and in limited instances, Social Security numbers. Episource engaged forensic investigators, notified law enforcement, and shut down systems. They are offering two years of credit monitoring.
California clockDiscovered Feb 6, 2025 → Notified Nov 12, 2025279d ✗ CA 60-day late40 weeks discovery → filing
Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-614134
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Nov 12, 2025
- Raw hash
- 46b3f63de7914541ccbfe004fd51bcfb8e4550a87f2bd004ada249d742f4b05e
Reporting entity
- Name
- EpiSourcenorm: episource
Victim entity
- Name
- EpiSourcenorm: episource
Incident
- Discovered
- Feb 6, 2025
- Materiality determined
- —
- Notification sent
- Nov 12, 2025
- Affected individuals
- Not disclosed
- Data types
- PHIIDENTITY_BASICIDENTITY_GOVERNMENTHEALTH_BASICFINANCIAL_ACCOUNT
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
- Threat actor
- External
Compliance
- Time to disclose
- 40 weeks(279 days from discovery to filing)
- Compliance flags
- CA 60-day late · 279d
- Discovery-date grounding
- letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Feb 6, 2025→ Notified: Nov 12, 2025279d 60 days (analyst band, pre-2026 discoveries) CA 60-day late
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.