PhysicalHealthcareHealthcareTheftCustomer Data InvolvedPHIHealth (basic)Identity (basic)LowContained

American Sleep Medicine

bd_2d67eb1294a3dc28 · schema v1 · pii pii-v1

Severity

Low

Discovered

Mar 3, 2015

Filed

Apr 16, 2015

To disclose

6 weeks

Affected

Not disclosed

Linked

2 filings

Confidence

66%

Full breach record for American Sleep Medicine →

American Sleep Medicine reported the theft of an external hard drive from a locked server room in San Diego, discovered on March 3, 2015. The drive contained patient information from 2012 sleep studies, including names, dates of birth, medical history, and sleep study results. No SSNs or financial data were involved. The company reported the theft to police and offered 90 days of credit monitoring.

J jump to incidentP pin to compareR raw source

California clockDiscovered Mar 3, 2015 → Notified Apr 15, 201543d ✓ CA 60-day OK6 weeks discovery → filing

Incident timeline

discovery → filing · 6 weeks / 44 days

Mar 3, 2015

Begins

Mar 3, 2015

Discovered

Apr 16, 2015

Filed

vs. sector median

6 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

HHS OCRbd_134aa3e249e40b7a2015-04-16Verified

Name: American Sleep Medicine
norm: american sleep medicine
Domain: americansleepmedicine.com

Name: American Sleep Medicine
norm: american sleep medicine
Domain: americansleepmedicine.com
Industry: Healthcarellm

Discovered: Mar 3, 2015
Breach occurred: Mar 3, 2015
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 15, 2015
Affected individuals: Not disclosed
Data types: PHIHealth (basic)Identity (basic)
Attack vector: Unknown
MITRE ATT&CK: T1052 Exfiltration Over Physical Medium

During the incident: Reported the incident to the San Diego Police Department
Offering 90 days of complimentary credit monitoring through Experian
Changes made: Removing and destroying all remaining external hard drives moving forward
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(44 days from discovery to filing)
Compliance flags: CA 60-day OK · 43d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Mar 3, 2015
→ Notified: Apr 15, 2015
43d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Mar 3, 2015 → Notified: Apr 15, 2015	43d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings

View merged incident ↗

HHS OCRApr 16 · first

California State AGApr 16 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-49386
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 16, 2015
Raw hash: 8781d33a94fb096620ed3399a333e5aae8f1b74f6aa9a8f689e6abe8a26d00e2

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityAmerican Sleep Medicine

Victim entityAmerican Sleep Medicine

Incidentdiscovered Mar 3, 2015

Stated responseReported the incident to the San Diego Police Department

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov