AccidentalHealthcareGovernmentHealthcareMisdeliveryEmployee Data InvolvedGovernment IDEmploymentMediumResolved

California Correctional Health Care Services

bd_59627810948c9391 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 20, 2012

Filed

Sep 13, 2012

To disclose

12 weeks

Affected

Not disclosed

Confidence

65%

Full breach record for California Correctional Health Care Services →13 incidents on file

On June 20, 2012, a staff member at California Correctional Health Care Services (CCHCS) inadvertently emailed Social Security Numbers along with leave balance information to other staff members within California Department of Corrections and Rehabilitation institutions. CCHCS issued a recall request for the email but could not determine if recipients read it. Notices were sent on July 10, 2012. CCHCS stated it has taken steps to mitigate recurrence.

J jump to incidentP pin to compareR raw source

California clockDiscovered Jun 20, 2012 → Notified Jul 10, 201220d ✓ CA 60-day OK12 weeks discovery → filing

Incident timeline

discovery → filing · 12 weeks / 85 days

Jun 20, 2012

Begins

Jun 20, 2012

Discovered

Sep 13, 2012

Filed

vs. sector median

on median

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: California Correctional Health Care Services
norm: california correctional health care

Name: California Correctional Health Care Services
norm: california correctional health care
Industry: HealthcarellmGovernmentllm

Discovered: Jun 20, 2012
Breach occurred: Jun 20, 2012
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 10, 2012
Affected individuals: Not disclosed
Data types: Government IDEmployment
Data elements: Social Security number
Attack vector: Unknown
Threat actor: Internal

During the incident: Recall request for the email was made to prevent opening and reading the message
Changes made: CCHCS has taken steps to mitigate this type of event from recurrence
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 12 weeks(85 days from discovery to filing)
Compliance flags: CA 60-day OK · 20d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Jun 20, 2012
→ Notified: Jul 10, 2012
20d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Jun 20, 2012 → Notified: Jul 10, 2012	20d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-36435
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 13, 2012
Raw hash: 20393297f191d952a51e8edc81575375fe595e56c2fef64d8f95fc8e2f0a62a3

Reporting entityCalifornia Correctional Health Care Services

Victim entityCalifornia Correctional Health Care Services

Incidentdiscovered Jun 20, 2012

Stated responseRecall request for the email was made to prevent opening and reading the message

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov