AccidentalHealthcareHealthcareMisconfigurationSupply Chain (3P Vendor)Customer Data InvolvedData ExfiltratedIdentity (basic)Health (basic)BehaviorLowContained

Amarin Pharma, Inc.

bd_3cba5462ce63c3f4 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jun 20, 2019

Filed

Aug 5, 2019

To disclose

7 weeks

Affected

Not disclosed

Confidence

64%

Full breach record for Amarin Pharma, Inc. →

Amarin Pharma, Inc. notified consumers that a third-party vendor's database, containing names, addresses, and health-related information for Vascepa copay card users, was misconfigured and accessible without authorization from May 2, 2018, to June 20, 2019. Evidence of unauthorized access and acquisition was identified between May 29, 2019, and June 20, 2019. No SSNs or financial account information were involved. Amarin suspended data feeds and the vendor engaged forensic investigators.

J jump to incidentP pin to compareR raw source

California clockDiscovered Jun 20, 2019 → Notified Aug 5, 201946d ✓ CA 60-day OK7 weeks discovery → filing

Incident timeline

undetected · 414 days

discovery → filing · 7 weeks / 46 days

May 2, 2018

Begins

Jun 20, 2019

Discovered

Aug 5, 2019

Filed

vs. sector median

3 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: Amarin Pharma, Inc.
norm: amarin pharma

Name: Amarin Pharma, Inc.
norm: amarin pharma
Industry: Healthcarellm

Discovered: Jun 20, 2019
Breach occurred: May 2, 2018 – Jun 20, 2019
Undetected for: 414 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 5, 2019
Affected individuals: Not disclosed
Data types: Identity (basic)Health (basic)Behavior
Attack vector: Third-Party / Supply Chain
Threat actor: External
Third party: via Third party vendor

During the incident: Suspended active data feeds to the vendor’s database
Working with vendor and leading experts to confirm the scope of this matter
Vendor engaged a forensic investigator to evaluate the security of its systems
Will not authorize bringing the database back online until appropriate safeguards are in place
Changes made: Taken steps to assure that the vendor’s database is secure from further unauthorized access
Taken steps to ensure that any copay cards for Vascepa accessed from the vendor-supported website remain active for continued use
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 weeks(46 days from discovery to filing)
Compliance flags: CA 60-day OK · 46d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Jun 20, 2019
→ Notified: Aug 5, 2019
46d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Jun 20, 2019 → Notified: Aug 5, 2019	46d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-149444
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 5, 2019
Raw hash: 5dfabcae3c46f98cdf259a638285cdbfc745861c980cf335e321a8d191dcf534

Reporting entityAmarin Pharma, Inc.

Victim entityAmarin Pharma, Inc.

Incidentdiscovered Jun 20, 2019

Stated responseSuspended active data feeds to the vendor’s database

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov