HackingData ExfiltratedCustomer Data InvolvedDelayed DiscoveryPHIHEALTH_BASICIDENTITY_BASICLowContained
James J. Lynch, MD Ltd.
bd_46f5c3da1506e1ed · schema v1 · pii pii-v1
Full breach record for James J. Lynch, MD Ltd. →James J. Lynch, MD Ltd. dba Swift Institute, a medical provider, notified the California Attorney General of a security incident. The breach occurred between January 28 and January 30, 2025, and was discovered on January 30, 2025. An unauthorized individual copied files containing personal and protected health information. The organization confirmed the involvement of affected individuals' data on October 14, 2025, and sent notifications on December 10, 2025. Affected individuals are offered 12 months of credit monitoring and fraud assistance.
California clockDiscovered Jan 30, 2025 → Notified Dec 10, 2025314d ✗ CA 60-day late45 weeks discovery → filing
This filing is one of 3 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (2) · sorted by filing gap
- bd_c3a4d39b02a7b3b3Montana State AGfiled 2025-12-12Verified
- bd_d2a77129f94bfc61Vermont State AGfiled 2025-12-12Verified
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-615654
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Dec 12, 2025
- Raw hash
- 0e41cf4f02e045f1c7812000d6a0bb0c111e282a564f5d2b71364fb28d41dc46
Reporting entity
- Name
- James J. Lynch, MD Ltd.norm: james j lynch md
Victim entity
- Name
- James J. Lynch, MD Ltd.norm: james j lynch md
Incident
- Discovered
- Jan 30, 2025
- Materiality determined
- —
- Notification sent
- Dec 10, 2025
- Affected individuals
- Not disclosed
- Data types
- PHIHEALTH_BASICIDENTITY_BASIC
- Attack vector
- Unknown
- MITRE ATT&CK
- T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
- Threat actor
- External
Compliance
- Time to disclose
- 45 weeks(316 days from discovery to filing)
- Compliance flags
- CA 60-day late · 314d
- Discovery-date grounding
- letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Jan 30, 2025→ Notified: Dec 10, 2025314d 60 days (analyst band, pre-2026 discoveries) CA 60-day late
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.