AccidentalProgramming ErrorCustomer Data InvolvedEmployee Data InvolvedIDENTITY_BASICIDENTITY_GOVERNMENTHEALTH_BASICPHIMediumResolved
ZOCDOC, INC.
bd_52fc8b554a43992b · schema v1 · pii pii-v1
Full breach record for ZOCDOC, INC. →ZocDoc, Inc. disclosed a data breach caused by programming errors that allowed some past or current staff members of medical or dental practices to access the ZocDoc Provider Portal after their authorization was intended to be revoked. The incident began in August 2020. Affected data may include names, email addresses, phone numbers, appointment history, insurance member IDs, Social Security numbers, and relevant medical history. ZocDoc repaired the errors, notified affected practices, and offered 12 months of identity monitoring via Experian.
California clockDiscovered Aug 1, 2020 → Notified May 28, 2021300d ✗ CA 60-day late42 weeks discovery → filing
Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-541087
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- May 20, 2021
- Raw hash
- 4e34debaf9a35d73701ee46550aa430d1d0597cda3c79ea51858d1b64b50b988
Reporting entity
- Name
- ZOCDOC, INC.norm: zocdoc
- Domain
- zocdoc.com
Victim entity
- Name
- ZOCDOC, INC.norm: zocdoc
- Domain
- zocdoc.com
Incident
- Discovered
- Aug 1, 2020
- Materiality determined
- —
- Notification sent
- May 28, 2021
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENTHEALTH_BASICPHI
- Attack vector
- Unknown
Compliance
- Time to disclose
- 42 weeks(292 days from discovery to filing)
- Compliance flags
- CA 60-day late · 300d
- Discovery-date grounding
- letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Aug 1, 2020→ Notified: May 28, 2021300d 60 days (analyst band, pre-2026 discoveries) CA 60-day late
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.