AccidentalHealthcareTechnologyHealthcareProgramming ErrorCustomer Data InvolvedIdentity (basic)Health (basic)LowResolved

ZOCDOC, INC.

bd_50641af42be3e964 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jun 1, 2015

Filed

May 16, 2016

To disclose

50 weeks

Affected

Not disclosed

Confidence

66%

Full breach record for ZOCDOC, INC. →3 incidents on file

Zocdoc, Inc. notified California residents that programming errors in its Provider Dashboard access management allowed some past or current staff members of medical/dental practices to potentially view personal information (name, email, phone, appointment history, insurance ID, medical history) after their authorization was revoked. The error was discovered in June 2015 and repaired. No financial data or SSNs were stored, though SSN was listed as potentially accessed if previously provided. Zocdoc offered one year of Experian ProtectMyID Elite.

J jump to incidentP pin to compareR raw source

California clockDiscovered Jun 1, 2015 → Notified May 16, 2016350d ✗ CA 60-day late50 weeks discovery → filing

Incident timeline

discovery → filing · 50 weeks / 350 days

Jun 1, 2015

Discovered

May 16, 2016

Filed

vs. sector median

+41 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: ZOCDOC, INC.
norm: zocdoc
Domain: zocdoc.com

Name: ZOCDOC, INC.
norm: zocdoc
Domain: zocdoc.com
Industry: HealthcarellmTechnologyllm

Discovered: Jun 1, 2015
Materiality determined: —
Notification sent: May 16, 2016
Affected individuals: Not disclosed
Data types: Identity (basic)Health (basic)
Attack vector: Unknown

During the incident: Launched a thorough investigation of our software and website
Repaired these errors
Affected usernames can no longer access our system
Strengthened our security practices
Arranged a complimentary one-year membership of Experian’s® ProtectMyID® Elite service
Changes made: Repaired programming errors in the processes responsible for managing username access
Strengthened our security practices
Will continue to regularly audit our system security and take action to enhance it
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 50 weeks(350 days from discovery to filing)
Compliance flags: CA 60-day late · 350d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Jun 1, 2015
→ Notified: May 16, 2016
350d 60 days (analyst band, pre-2026 discoveries) CA 60-day late

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Jun 1, 2015 → Notified: May 16, 2016	350d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-61838
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 16, 2016
Raw hash: eabbd4e2360d466eb653fcafbeb0f39ea0e4c2773a2a38ce511d5772604522f5

Reporting entityZOCDOC, INC.

Victim entityZOCDOC, INC.

Incidentdiscovered Jun 1, 2015

Stated responseLaunched a thorough investigation of our software and website

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov