MalwareRansomwareData EncryptedData ExfiltratedCustomer Data InvolvedPHIIDENTITY_BASICIDENTITY_GOVERNMENTHEALTH_BASICMediumContained
medQ, Inc.
bd_5a44626b9e34f658 · schema v1 · pii pii-v1
Full breach record for medQ, Inc. →medQ, Inc. experienced a ransomware incident where files were encrypted and exfiltrated from its software platform hosted by a third-party data center between December 20-26, 2023. The breach affected individuals' PHI, including names, SSNs, driver's license numbers, diagnoses, and treatment information. medQ disconnected the network, engaged forensic investigators, and is offering 12 months of credit monitoring.
California clockDiscovered Dec 26, 2023 → Notified Feb 16, 202452d ✓ CA 60-day OK8 weeks discovery → filing
This filing is one of 5 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (4) · sorted by filing gap
- bd_bdb2089ed777401bIndiana State AGfiled 2024-02-23Verified
- bd_dcfa5a8e797d467dMaine State AGfiled 2024-02-23Candidate
- bd_e84e7d460997ea88Montana State AGfiled 2024-02-23Verified
- bd_7756d64c62956c67California State AGfiled 2024-05-29(96d gap)Verified
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-581459
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Feb 23, 2024
- Raw hash
- 43a1130aae49eff08aaf855e4eaed7fc8bddeb7d7007c7a618b9fbe129701023
Reporting entity
- Name
- medQ, Inc.norm: medq
Victim entity
- Name
- medQ, Inc.norm: medq
Incident
- Discovered
- Dec 26, 2023
- Materiality determined
- —
- Notification sent
- Feb 16, 2024
- Affected individuals
- Not disclosed
- Data types
- PHIIDENTITY_BASICIDENTITY_GOVERNMENTHEALTH_BASIC
- Attack vector
- Ransomware
- MITRE ATT&CK
- T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
- Threat actor
- External
Compliance
- Time to disclose
- 8 weeks(59 days from discovery to filing)
- Compliance flags
- CA 60-day OK · 52d
- Discovery-date grounding
- letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Dec 26, 2023→ Notified: Feb 16, 202452d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.