HackingHealthcareHealthcareStolen CredentialsCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Government IDHealth (basic)Financial accountPHIMediumContained

Angeion Group

bd_4938df9c4594e1de · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 1, 2020

Filed

Dec 4, 2020

To disclose

22 weeks

Affected

Not disclosed

Linked

6 filings

Confidence

65%

Full breach record for Angeion Group →2 incidents on file

Angeion Group disclosed that an unknown third party accessed an employee's corporate email box without authorization between March 30, 2020, and May 4, 2020. The company learned of the incident in July 2020. The email box contained personal information including names, dates of birth, SSNs, driver's license numbers, medical/health insurance information, and financial account data. Angeion notified law enforcement, launched an investigation, and offered identity theft protection services to affected individuals. No evidence of misuse was found.

J jump to incidentP pin to compareR raw source

California clockDiscovered Jul 1, 2020 → Notified Dec 4, 2020156d ✗ CA 60-day late22 weeks discovery → filing

Incident timeline

undetected · 93 days

discovery → filing · 22 weeks / 156 days

Mar 30, 2020

Begins

Jul 1, 2020

Discovered

Dec 4, 2020

Filed

vs. sector median

+10 wks slower

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Maine State AGbd_156517af9aa79b422020-12-04Verified
Indiana State AGbd_77897c88822e40fc2020-12-04Verified
Montana State AGbd_7bd25b761761e6072020-12-04Candidate
New Hampshire State AGbd_cbc79fa4a0c43f4a2020-12-03 · +1dVerified

Show 1 more filing ↓up to 5d gap

Massachusetts State AGbd_97a50432e3f4f7d82020-12-09 · +5dVerified

Name: Angeion Group
norm: angeion group
Domain: angeiongroup.com

Name: Angeion Group
norm: angeion group
Domain: angeiongroup.com
Industry: Healthcarellm

Discovered: Jul 1, 2020
Breach occurred: Mar 30, 2020 – May 4, 2020
Undetected for: 93 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 4, 2020
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDHealth (basic)Financial accountPHI
Data elements: Social Security numberDate of birthMedical information
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: External
Initial access: valid_credentials

During the incident: Launched an investigation
Notified law enforcement of the incident
Offering free identity theft protection services through IDX
Changes made: Employee training
Security enhancements
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 22 weeks(156 days from discovery to filing)
Compliance flags: CA 60-day late · 156d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Jul 1, 2020
→ Notified: Dec 4, 2020
156d 60 days (analyst band, pre-2026 discoveries) CA 60-day late

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Jul 1, 2020 → Notified: Dec 4, 2020	156d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

New Hampshire State AGDec 3 · first

Maine State AG+1d

Indiana State AG+1d

Montana State AG+1d

California State AG+1d · this page

Massachusetts State AG+6d

Pattern: first filing Dec 3 (NH), last Dec 9 (MA) — a 6-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-196797
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 4, 2020
Raw hash: f94b1fe194907be263d9ee7caa36f564802b6090cf668a044367cb697a4c6536

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityAngeion Group

Victim entityAngeion Group

Incidentdiscovered Jul 1, 2020

Stated responseLaunched an investigation

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov