UnknownHealthcareManufacturingManufacturingCustomer Data InvolvedDelayed DiscoveryPIIIdentity (basic)Government IDFinancial accountFinancial credentialsHealth (basic)HighContained

Puma Biotechnology, Inc.

bd_5be9ea9e8d8f4073 · schema v1 · pii pii-v1

Severity

High

Discovered

Jun 19, 2022

Filed

May 17, 2023

To disclose

47 weeks

Affected

Not disclosed

Linked

7 records

Confidence

65%

Full breach record for Puma Biotechnology, Inc. →

Puma Biotechnology, Inc. discovered suspicious network activity on June 19, 2022. Investigation revealed unauthorized access to files between April 22 and June 19, 2022. Affected data may include names, SSNs, health info, and financial data. The company secured its network, engaged third-party specialists, and is offering credit monitoring. No indication of misuse was found.

J jump to incidentP pin to compareR raw source

California clockDiscovered Jun 19, 2022 → Notified May 17, 2023332d ✗ CA 60-day late47 weeks discovery → filing

Incident timeline

undetected · 58 days

discovery → filing · 47 weeks / 332 days

Apr 22, 2022

Begins

Jun 19, 2022

Discovered

May 17, 2023

Filed

vs. sector median

+38 wks slower

This filing is one of 7 records about the same incident.View merged incident

A leak claim by ragnarlocker about this victim was first seen 288 days before this filing.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Siteragnarlockerbd_29c4e75d5fe3e1272022-08-02 · +288dVerified

Regulatory filings (5) · sorted by filing gap

Indiana State AGbd_279da46eb3dae2502023-05-17Verified
Maine State AGbd_2d4efa68f0c437bd2023-05-17Verified
Massachusetts State AGbd_32457e786384d2dd2023-05-17Verified
Montana State AGbd_53e8ed2ab09e42bc2023-05-17Verified

Show 1 more filing ↓up to 5d gap

New Hampshire State AGbd_0d8eb8643496079e2023-05-22 · +5dVerified

Name: Puma Biotechnology, Inc.
norm: puma biotechnology

Name: Puma Biotechnology, Inc.
norm: puma biotechnology
Industry: Healthcarenaics mapManufacturingnaics map

Discovered: Jun 19, 2022
Breach occurred: Apr 22, 2022 – Jun 19, 2022
Undetected for: 58 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 17, 2023
Affected individuals: Not disclosed
Data types: PIIIdentity (basic)Government IDFinancial accountFinancial credentialsHealth (basic)
Attack vector: Unknown
Regulator citations: Reported this incident to federal law enforcementNotifying state and federal regulators

During the incident: Secured our network
Launched an investigation with the assistance of third-party computer specialists
Undertook a diligent and comprehensive review to determine the information present on the network
Conducted a comprehensive internal evaluation of the information
Reported this incident to federal law enforcement
Notifying state and federal regulators
Offering complimentary access to credit monitoring and identity theft restoration services through Epiq
Changes made: Reviewing and enhancing existing policies and procedures to reduce the likelihood of a similar future incident
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 47 weeks(332 days from discovery to filing)
Compliance flags: CA 60-day late · 332dLeak >180d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Jun 19, 2022
→ Notified: May 17, 2023
332d 60 days (analyst band, pre-2026 discoveries) CA 60-day late

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Jun 19, 2022 → Notified: May 17, 2023	332d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Indiana State AGMay 17 · first

Maine State AGMay 17 · first

Massachusetts State AGMay 17 · first

Montana State AGMay 17 · first

California State AGMay 17 · first · this page

New Hampshire State AG+5d

Pattern: first filing May 17 (IN), last May 22 (NH) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-566823
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 17, 2023
Raw hash: 189ba879a246a1de6d37ffadf62e3104d1d316208e10bee4a1d010e8ae18aad2

Linked disclosures

Ransomware claims (1)

Regulatory filings (5) · sorted by filing gap

Reporting entityPuma Biotechnology, Inc.

Victim entityPuma Biotechnology, Inc.

Incidentdiscovered Jun 19, 2022

Stated responseSecured our network

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov