Social EngineeringPhishingCustomer Data InvolvedPHIHEALTH_BASICIDENTITY_BASICLowContained
Outcomes
bd_30e22ddaec24070e · schema v1 · pii pii-v1
Full breach record for Outcomes →Outcomes One, Inc. notified California residents of a phishing incident on July 1, 2025, where an employee's email account was compromised. Unauthorized access lasted approximately one hour. Affected data may include names, demographic information, medical provider names, health insurance information, and medication information. Social Security numbers were not involved. The company engaged an outside specialist, secured the account, and implemented enhanced email safeguards and phishing training.
This filing is one of 7 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (6) · sorted by filing gap
- bd_25a352c6de9ebeffWashington State AGfiled 2025-09-23Verified
- bd_a6e85691ffe67aceOregon State AGfiled 2025-09-23Verified
- bd_bfd803f20d5ab6cdHHS OCRfiled 2025-09-23Verified
- bd_d5b332c2531136fbMontana State AGfiled 2025-09-23Verified
Show 2 more filings ↓Show fewer ↑up to 31d gap
- bd_1534c283b261f9d6California State AGfiled 2025-10-23(30d gap)Verified
- bd_a6f792d784d84ba3Texas State AGfiled 2025-10-24(31d gap)Verified
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-610436
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Sep 23, 2025
- Raw hash
- b05053971c34fad73149549a1bf41394fe4d3ccd5a7fa879a97788d7ef801cb5
Reporting entity
- Name
- Outcomesnorm: outcomes
- Domain
- outcomes.com
Victim entity
- Name
- Outcomesnorm: outcomes
- Domain
- outcomes.com
Incident
- Discovered
- Jul 1, 2025
- Materiality determined
- —
- Notification sent
- —
- Affected individuals
- Not disclosed
- Data types
- PHIHEALTH_BASICIDENTITY_BASIC
- Attack vector
- Phishing
- MITRE ATT&CK
- T1566.002 Spearphishing LinkT1114 Email Collection
- Threat actor
- External
- Initial access
- phishing_link
Compliance
- Time to disclose
- 12 weeks(84 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.