MalwareHealthcareHealthcareCustomer Data InvolvedEmployee Data InvolvedPHIIdentity (basic)Government IDHealth (basic)CriticalActive

Centrelake Medical Group, Inc.

bd_5a79055f0c129f24 · schema v1 · pii pii-v1

Severity

Critical

Discovered

Feb 19, 2019

Filed

Apr 16, 2019

To disclose

8 weeks

Affected

195,144state residents only

Linked

6 filings

Confidence

66%

Full breach record for Centrelake Medical Group, Inc. →2 incidents on file

Centrelake Medical Group, Inc. discovered on February 19, 2019, that its information system was infected with a virus introduced by an unknown third party. Suspicious activity occurred between January 9, 2019, and February 19, 2019. The incident potentially affected 195,144 California residents, exposing PHI, SSNs, and other PII. The investigation is ongoing. Centrelake is offering one year of identity monitoring.

J jump to incidentP pin to compareR raw source

California clockDiscovered Feb 19, 2019 → Notified Apr 16, 201956d ✓ CA 60-day OK8 weeks discovery → filing

Incident timeline

undetected · 41 days

discovery → filing · 8 weeks / 56 days

Jan 9, 2019

Begins

Feb 19, 2019

Discovered

Apr 16, 2019

Filed

vs. sector median

4 wks faster

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Montana State AGbd_2f595599bea258d22019-04-16Verified
HHS OCRbd_4d4ab4bdac39256b2019-04-16Verified
Massachusetts State AGbd_95491b3edc63f1312019-04-16Verified
New Hampshire State AGbd_e9c07bcc541493352019-04-22 · +6dVerified

Show 1 more filing ↓up to 29d gap

California State AGbd_1e7f4398452ebdf42019-05-15 · +29dVerified

Name: Centrelake Medical Group, Inc.
norm: centrelake medical

Name: Centrelake Medical Group, Inc.
norm: centrelake medical
Industry: Healthcarellm

Discovered: Feb 19, 2019
Breach occurred: Jan 9, 2019 – Feb 19, 2019
Undetected for: 41 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 16, 2019
Affected individuals: 195,144state-resident count only
Data types: PHIIdentity (basic)Government IDHealth (basic)
Attack vector: Unknown
MITRE ATT&CK: T1486 Data Encrypted for Impact
Threat actor: External
Regulator citations: Providing written notice of this incident to the Department of Health and Human ServicesProviding written notice of this incident to the Centers for Medicaid and Medicare ServicesProviding written notice of this incident to consumer reporting agencies and other state regulators

During the incident: Restored integrity of information system
Launched investigation with assistance of forensic expert
Providing 1 free year of identity monitoring and restoration services through Kroll
Established a dedicated hotline for individuals to contact with questions or concerns
Providing potentially impacted individuals with helpful information on how to protect against identity theft and fraud
Issued a press release regarding this incident to media serving California
Posted notice of this incident on the homepage of its website
Providing written notice of this incident to business partners and potentially impacted individuals
Providing written notice of this incident to the Department of Health and Human Services, the Centers for Medicaid and Medicare Services, as well as consumer reporting agencies and other state regulators
Changes made: Reviewing its processes, policies, and procedures that address data privacy
Enhancing the security of its information system to mitigate the risk an incident like this will occur in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(56 days from discovery to filing)
Compliance flags: CA 60-day OK · 56d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Feb 19, 2019
→ Notified: Apr 16, 2019
56d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Feb 19, 2019 → Notified: Apr 16, 2019	56d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 4 states

View merged incident ↗

Montana State AGApr 16 · first

HHS OCRApr 16 · first

Massachusetts State AGApr 16 · first

California State AGApr 16 · first · this page

New Hampshire State AG+6d

California State AG+29d

Pattern: first filing Apr 16 (MT), last May 15 (CA) — a 29-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-146402
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 16, 2019
Raw hash: 579c2858a5dc0c19ff5064c0119e0052e409e958882b751f5a158eff869ad5a1

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityCentrelake Medical Group, Inc.

Victim entityCentrelake Medical Group, Inc.

Incidentdiscovered Feb 19, 2019

Stated responseRestored integrity of information system

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov