AccidentalHealthcareHealthcareMisconfigurationSupply Chain (3P Vendor)Customer Data InvolvedEmployee Data InvolvedPHIHealth (basic)Government IDIdentity (basic)MediumContained

Watsonville Chiropractic, Inc.

bd_4a370167f1b2f480 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 11, 2016

Filed

Nov 17, 2016

To disclose

10 weeks

Affected

Not disclosed

Linked

2 filings

Confidence

64%

Full breach record for Watsonville Chiropractic, Inc. →

Watsonville Chiropractic, Inc. notified patients of a data breach involving protected health information (PHI) and Social Security numbers. The incident resulted from a misconfiguration of an Amazon S3 storage account managed by a third-party billing software vendor, which was accessible to the public from May 2016 to September 11, 2016. A security researcher accessed and downloaded the data on September 10, 2016, and deleted it upon notification. The organization offered credit monitoring services and notified regulators.

J jump to incidentP pin to compareR raw source

California clockDiscovered Sep 11, 2016 → Notified Nov 15, 201665d ✗ CA 60-day late10 weeks discovery → filing

Incident timeline

undetected · 133 days

discovery → filing · 10 weeks / 67 days

May 1, 2016

Begins

Sep 11, 2016

Discovered

Nov 17, 2016

Filed

vs. sector median

+1 wks slower

This filing is one of 2 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

HHS OCRbd_5ffc056147ab8dcc2016-11-17Verified

Name: Watsonville Chiropractic, Inc.
norm: watsonville chiropractic

Name: Watsonville Chiropractic, Inc.
norm: watsonville chiropractic
Industry: Healthcarellm

Discovered: Sep 11, 2016
Breach occurred: May 1, 2016 – Sep 11, 2016
Undetected for: 133 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 15, 2016
Affected individuals: Not disclosed
Data types: PHIHealth (basic)Government IDIdentity (basic)
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain Compromise
Threat actor: External
Regulator citations: Providing notice of this incident to certain state regulators and the Department of Health and Human Services
Third party: via billing software company
Initial access: external_remote_services

During the incident: In communication with the billing software company to ensure that access to the storage account is restricted and that proper access credentials are in place
Confirmed that the security researcher deleted all the information downloaded
Providing notice of this incident to all potentially impacted individuals
Arranged with Equifax Personal Solutions to help protect personal information at no cost
Providing notice of this incident to certain state regulators and the Department of Health and Human Services
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 10 weeks(67 days from discovery to filing)
Compliance flags: CA 60-day late · 65d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Sep 11, 2016
→ Notified: Nov 15, 2016
65d 60 days (analyst band, pre-2026 discoveries) CA 60-day late

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Sep 11, 2016 → Notified: Nov 15, 2016	65d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings

View merged incident ↗

HHS OCRNov 17 · first

California State AGNov 17 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-64960
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 17, 2016
Raw hash: dace405b7f7d445eaeda26a6d6495c135e0a72d992d158a03d587e7b3f2ba2a8

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityWatsonville Chiropractic, Inc.

Victim entityWatsonville Chiropractic, Inc.

Incidentdiscovered Sep 11, 2016

Stated responseIn communication with the billing software company to ensure that access to the storage account is restricted and that proper access credentials are in place

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov