HackingSupply Chain (3P Vendor)Business Associate (HIPAA)Customer Data InvolvedPHIHEALTH_BASICIDENTITY_BASICLowContained
CONCENTRA HEALTH SERVICES, INC.
bd_27284fad0ae3ed71 · schema v1 · pii pii-v1
Full breach record for CONCENTRA HEALTH SERVICES, INC. →Perry Johnson & Associates (PJ&A), a medical transcription vendor for Concentra Health Services, experienced unauthorized access to systems containing Concentra patient data between March 27 and May 2, 2023. PJ&A detected suspicious activity on May 2, 2023. The incident involved a third-party vendor compromise. Affected data includes names, addresses, and health information. PJ&A offered credit monitoring to affected individuals.
California clockDiscovered May 2, 2023 → Notified Feb 8, 2024282d ✗ CA 60-day late40 weeks discovery → filing
Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-580744
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Feb 8, 2024
- Raw hash
- a7b1286d7f0d975add3b6b792f2e2df49fdc86270af838959e62a5b5562aa1d3
Reporting entity
- Name
- Perry Johnson Laboratory Accreditation, Inc.norm: perry johnson laboratory accreditation
- Domain
- pjlabs.com
Victim entity
- Name
- CONCENTRA HEALTH SERVICES, INC.norm: concentra health
Incident
- Discovered
- May 2, 2023
- Materiality determined
- —
- Notification sent
- Feb 8, 2024
- Affected individuals
- Not disclosed
- Data types
- PHIHEALTH_BASICIDENTITY_BASIC
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1078 Valid Accounts
- Threat actor
- External
- Third party
- via Perry Johnson & Associates, Inc.
Compliance
- Time to disclose
- 40 weeks(282 days from discovery to filing)
- Compliance flags
- CA 60-day late · 282d
- Discovery-date grounding
- letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: May 2, 2023→ Notified: Feb 8, 2024282d 60 days (analyst band, pre-2026 discoveries) CA 60-day late
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.