Social EngineeringHealthcareHealthcarePhishingStolen CredentialsCustomer Data InvolvedEmployee Data InvolvedGovernment IDIdentity (basic)Health (basic)MediumContained

BIOMARIN PHARMACEUTICAL INC.

bd_2a9bee3fa04b251f · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 21, 2018

Filed

Oct 11, 2018

To disclose

16 weeks

Affected

Not disclosed

Confidence

66%

Full breach record for BIOMARIN PHARMACEUTICAL INC. →3 incidents on file

BioMarin Pharmaceutical Inc. disclosed a phishing attack where an attacker accessed two employee email mailboxes starting June 18, 2018, using stolen credentials from a temporary employee. The incident was discovered on June 21, 2018. Affected individuals may have had their name, Social Security Number, and health insurance policy number exposed. BioMarin changed credentials to contain the breach and offered one year of LifeLock identity protection.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 3 days

discovery → filing · 16 weeks / 112 days

Jun 18, 2018

Begins

Jun 21, 2018

Discovered

Oct 11, 2018

Filed

vs. sector median

+4 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: BIOMARIN PHARMACEUTICAL INC.
norm: biomarin pharmaceutical
Domain: biomarin.com

Name: BIOMARIN PHARMACEUTICAL INC.
norm: biomarin pharmaceutical
Domain: biomarin.com
Industry: Healthcarellm

Discovered: Jun 21, 2018
Breach occurred: Jun 18, 2018 – Jun 21, 2018
Undetected for: 3 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Government IDIdentity (basic)Health (basic)
Data elements: Social Security number
Attack vector: Phishing
MITRE ATT&CK: T1566 PhishingT1078 Valid AccountsT1114 Email Collection
Threat actor: External
Initial access: phishing_link

During the incident: Changed temporary employee credentials to prevent further access
Working to secure network and prevent further attacks
Offering complimentary one-year membership of LifeLock’s identity theft protection / credit monitoring
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 16 weeks(112 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-140662
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 11, 2018
Raw hash: 332e01ef85434082cfcf87ca124d15f13887701069026af1f8740b17ac570f96

Reporting entityBIOMARIN PHARMACEUTICAL INC.

Victim entityBIOMARIN PHARMACEUTICAL INC.

Incidentdiscovered Jun 21, 2018

Stated responseChanged temporary employee credentials to prevent further access

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov