HackingStolen CredentialsSupply Chain (3P Vendor)Business Associate (HIPAA)Customer Data InvolvedDelayed DiscoveryPHIIDENTITY_BASICIDENTITY_GOVERNMENTHEALTH_BASICMediumContained
Mission Neighborhood Health Center
bd_4b85bc48af898dee · schema v1 · pii pii-v1
Full breach record for Mission Neighborhood Health Center →Mission Neighborhood Health Center (MNHC) notified patients of a data breach involving protected health information (PHI) due to unauthorized access to systems of TriZetto, a subcontractor of MNHC's business associate OCHIN. The incident occurred in November 2024 but was not discovered until December 2025. Affected data includes names, addresses, dates of birth, potential SSNs, and health insurance information. No payment card data was involved. MNHC is cooperating with OCHIN and TriZetto on mitigation and reporting to regulators.
California clockDiscovered Dec 12, 2025 → Notified Dec 31, 202519d ✓ CA 60-day OK26 days discovery → filing
Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-616679
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jan 7, 2026
- Raw hash
- 5947e50e0b516ed4c3128a34317566c4c964131d6ac9e73798a18af3254052d5
Reporting entity
- Name
- Mission Neighborhood Health Centernorm: mission neighborhood health center
- Domain
- mnhc.org
Victim entity
- Name
- Mission Neighborhood Health Centernorm: mission neighborhood health center
- Domain
- mnhc.org
Incident
- Discovered
- Dec 12, 2025
- Materiality determined
- —
- Notification sent
- Dec 31, 2025
- Affected individuals
- Not disclosed
- Data types
- PHIIDENTITY_BASICIDENTITY_GOVERNMENTHEALTH_BASIC
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1078 Valid Accounts
- Threat actor
- External
- Regulator citations
- Will report this incident to the California Department of Public HealthWill report this incident to U.S. Department of Health and Human ServicesWill report this incident to California Attorney General’s Office
- Third party
- via TriZetto
- Initial access
- supply_chain
Compliance
- Time to disclose
- 26 days(26 days from discovery to filing)
- Compliance flags
- CA 60-day OK · 19d
- Discovery-date grounding
- letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Dec 12, 2025→ Notified: Dec 31, 202519d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.