HackingHealthcareHealthcareSupply Chain (3P Vendor)Business Associate (HIPAA)Customer Data InvolvedPHIHealth (basic)Identity (basic)LowContained

CONCENTRA HEALTH SERVICES, INC.

bd_27284fad0ae3ed71 · schema v1 · pii pii-v1

Severity

Low

Discovered

May 2, 2023

Filed

Feb 8, 2024

To disclose

40 weeks

Affected

Not disclosed

Confidence

64%

Full breach record for CONCENTRA HEALTH SERVICES, INC. →4 incidents on file

Perry Johnson & Associates (PJ&A), a medical transcription vendor for Concentra Health Services, experienced unauthorized access to systems containing Concentra patient data between March 27 and May 2, 2023. PJ&A detected suspicious activity on May 2, 2023. The incident involved a third-party vendor compromise. Affected data includes names, addresses, and health information. PJ&A offered credit monitoring to affected individuals.

J jump to incidentP pin to compareR raw source

California clockDiscovered May 2, 2023 → Notified Feb 8, 2024282d ✗ CA 60-day late40 weeks discovery → filing

Incident timeline

undetected · 36 days

discovery → filing · 40 weeks / 282 days

Mar 27, 2023

Begins

May 2, 2023

Discovered

Feb 8, 2024

Filed

vs. sector median

+28 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: Perry Johnson & Associates, Inc.
norm: perry johnson associates
Domain: pjlabs.com

Name: CONCENTRA HEALTH SERVICES, INC.
norm: concentra health
Industry: Healthcarellm

Discovered: May 2, 2023
Breach occurred: Mar 27, 2023 – May 2, 2023
Undetected for: 36 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 8, 2024
Affected individuals: Not disclosed
Data types: PHIHealth (basic)Identity (basic)
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Third party: via Perry Johnson & Associates, Inc.

During the incident: Launched an investigation with the assistance of third-party cybersecurity specialists
Notified Concentra of the event
Provided Concentra with a list of its potentially impacted patients
Concentra launched its own investigation to validate results
Offering credit monitoring services through IDX
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 40 weeks(282 days from discovery to filing)
Compliance flags: CA 60-day late · 282d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: May 2, 2023
→ Notified: Feb 8, 2024
282d 60 days (analyst band, pre-2026 discoveries) CA 60-day late

Statute	Window	Elapsed	Threshold	Status
California	Discovered: May 2, 2023 → Notified: Feb 8, 2024	282d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-580744
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 8, 2024
Raw hash: a7b1286d7f0d975add3b6b792f2e2df49fdc86270af838959e62a5b5562aa1d3

Reporting entityPerry Johnson & Associates, Inc.

Victim entityCONCENTRA HEALTH SERVICES, INC.

Incidentdiscovered May 2, 2023

Stated responseLaunched an investigation with the assistance of third-party cybersecurity specialists

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov