HackingStolen CredentialsCustomer Data InvolvedData ExfiltratedPHIHEALTH_BASICIDENTITY_BASICLowContained
Catalyst RCM
bd_5757e6104d4bc382 · schema v1 · pii pii-v1
Full breach record for Catalyst RCM →Catalyst RCM notified individuals of a data privacy event where an authorized login was used to access a server and copy data without permission between November 8-9, 2025. The incident was discovered on November 13, 2025. Affected data included explanation of benefits letters containing names and other health-related information. Catalyst offered identity theft protection services.
California clockDiscovered Nov 13, 2025 → Notified Feb 6, 202685d ✗ CA 60-day late12 weeks discovery → filing
Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-618350
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Feb 6, 2026
- Raw hash
- 33d58a75d7f4ceed6c892f9658ab55cb494e0dfc2d32fc838da15e2addea3266
Reporting entity
- Name
- Catalyst RCMnorm: catalyst rcm
Victim entity
- Name
- Catalyst RCMnorm: catalyst rcm
Incident
- Discovered
- Nov 13, 2025
- Materiality determined
- —
- Notification sent
- Feb 6, 2026
- Affected individuals
- Not disclosed
- Data types
- PHIHEALTH_BASICIDENTITY_BASIC
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1078 Valid AccountsT1119 Automated Collection
- Initial access
- valid_credentials
Compliance
- Time to disclose
- 12 weeks(85 days from discovery to filing)
- Compliance flags
- CA 60-day late · 85dCA AG copy ≤15d · 0d
- Discovery-date grounding
- letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Nov 13, 2025→ Notified: Feb 6, 202685d 60 days (analyst band, pre-2026 discoveries) CA 60-day late California Consumers notified: Feb 6, 2026→ AG copy submitted: Feb 6, 20260d 15 calendar days CA AG copy ≤15d
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.