HackingHealthcareHealthcareBusiness Associate (HIPAA)Customer Data InvolvedData ExfiltratedIdentity (basic)Government IDFinancial accountPHIHealth (basic)MediumContained

Nationwide Optometry, PC

bd_3a70be4ee1cba8bc · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 12, 2021

Filed

Oct 28, 2022

To disclose

18 months

Affected

Not disclosed

Linked

4 filings

Confidence

66%

Full breach record for Nationwide Optometry, PC →

Nationwide Optometry, P.C. notified California residents that U.S. Vision, Inc., a former business associate, experienced unauthorized access to its network between April 20, 2021, and May 17, 2021. U.S. Vision detected suspicious activity on May 12, 2021. The incident may have exposed personal information including names, dates of birth, addresses, Social Security numbers, driver's license numbers, financial account information, and medical/treatment records. U.S. Vision engaged cybersecurity specialists and offered credit monitoring services.

J jump to incidentP pin to compareR raw source

California clockDiscovered May 12, 2021 → Notified Oct 28, 2022534d ✗ CA 60-day late18 months discovery → filing

Incident timeline

undetected · 22 days

discovery → filing · 18 months / 534 days

Apr 20, 2021

Begins

May 12, 2021

Discovered

Oct 28, 2022

Filed

vs. sector median

+64 wks slower

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Oregon State AGbd_628b9700851b3b432022-10-28Verified
HHS OCRbd_70a748aee42d29202022-10-28Verified by operator
Massachusetts State AGbd_75ee194d362efd952022-10-28Verified by operator

Name: Nationwide Optometry, PC
norm: nationwide optometry

Name: Nationwide Optometry, PC
norm: nationwide optometry
Industry: Healthcarellm

Discovered: May 12, 2021
Breach occurred: Apr 20, 2021 – May 17, 2021
Undetected for: 22 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 28, 2022
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDFinancial accountPHIHealth (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
Threat actor: External
Third party: via U.S. Vision, Inc.

During the incident: Launched an investigation into the nature and scope of the incident with the assistance of cybersecurity specialists
Instituted dark web monitoring for any potential data that could have been involved in this incident
Conducted a comprehensive review of the impacted files to determine what information was affected and to whom the information related
Offered credit monitoring and identity restoration services for a period of 12/24 months, at no cost
Changes made: Evaluating opportunities to improve security and to better prevent future events of this kind
Enhanced security controls and monitor systems to ensure no similar activity occurs
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 18 months(534 days from discovery to filing)
Compliance flags: CA 60-day late · 534d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: May 12, 2021
→ Notified: Oct 28, 2022
534d 60 days (analyst band, pre-2026 discoveries) CA 60-day late

Statute	Window	Elapsed	Threshold	Status
California	Discovered: May 12, 2021 → Notified: Oct 28, 2022	534d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Oregon State AGOct 28 · first

HHS OCROct 28 · first

Massachusetts State AGOct 28 · first

California State AGOct 28 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-558714
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 28, 2022
Raw hash: 313ce93ba29d0e3ee522edce9ee8a6b421c97ad3435f62ade765ceec06b27137

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityNationwide Optometry, PC

Victim entityNationwide Optometry, PC

Incidentdiscovered May 12, 2021

Stated responseLaunched an investigation into the nature and scope of the incident with the assistance of cybersecurity specialists

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov