HackingHealthcareHealthcareStolen CredentialsData ExfiltratedCustomer Data InvolvedGovernment IDIdentity (basic)Financial accountHighContained

DNA Diagnostics Center, Inc.

bd_5f3aeb1fe19a37fa · schema v1 · pii pii-v1

Severity

High

Discovered

Aug 6, 2021

Filed

Nov 29, 2021

To disclose

16 weeks

Affected

4,278state residents only

Linked

8 filings

Confidence

69%

Full breach record for DNA Diagnostics Center, Inc. →2 incidents on file

DNA Diagnostics Center, Inc. (DDC) notified the Washington Attorney General of unauthorized access to an archived genetic testing database. The breach affected approximately 4,278 Washington residents, exposing names, Social Security numbers, and some credit/debit card information. Access occurred between May 24, 2021, and July 28, 2021, but was detected on August 6, 2021. DDC offered complimentary credit monitoring via Experian and advised individuals to place fraud alerts or security freezes.

J jump to incidentP pin to compareR raw source

Washington clock✗ WA AG >90d16 weeks discovery → filing

Incident timeline

undetected · 74 days

discovery → filing · 16 weeks / 115 days

May 24, 2021

Begins

Aug 6, 2021

Discovered

Nov 29, 2021

Filed

vs. sector median

+4 wks slower

This filing is one of 8 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (7) · sorted by filing gap

Massachusetts State AGbd_05068130598ea2642021-11-29Verified
Indiana State AGbd_0db919450629372d2021-11-29Verified
Maine State AGbd_366739cb041487c92021-11-29Candidate
California State AGbd_6c235e9f21ab04902021-11-29Verified

Show 3 more filings ↓up to 16d gap

New Hampshire State AGbd_f130566fad2436172021-12-06 · +7dVerified
Oregon State AGbd_891e08eeecb2b6c42021-12-09 · +10dVerified
South Carolina State AGbd_77aaa27fc573f8892021-12-15 · +16dVerified

Name: DNA Diagnostics Center, Inc.
norm: dna diagnostics center
Domain: dnacenter.com

Name: DNA Diagnostics Center, Inc.
norm: dna diagnostics center
Domain: dnacenter.com
Industry: Healthcarellm

Discovered: Aug 6, 2021
Breach occurred: May 24, 2021 – Jul 28, 2021
Undetected for: 74 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 29, 2021
Affected individuals: 4,278state-resident count only
Data types: Government IDIdentity (basic)Financial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Filed notification with Washington Attorney General Consumer Protection Division
Initial access: valid_credentials

During the incident: Opened an investigation
Working closely with external cybersecurity professionals
Coordinated closely with law enforcement
Provided notification to affected individuals
Advising affected individuals about the process for placing fraud alerts and/or security freezes on their credit files
Advising individuals whose credit or debit card information was impacted to contact their financial institutions
Providing contact information for the consumer reporting agencies and the Federal Trade Commission
Offering complimentary credit monitoring through Experian
Changes made: Continually evaluates and modifies its practices and internal controls to enhance the security and privacy of personal information
Working with third-party experts to harden our cybersecurity defenses
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 16 weeks(115 days from discovery to filing)
Compliance flags: WA AG >90d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 8 states

View merged incident ↗

Massachusetts State AGNov 29 · first

Indiana State AGNov 29 · first

Maine State AGNov 29 · first

California State AGNov 29 · first

Washington State AGNov 29 · first · this page

New Hampshire State AG+7d

Oregon State AG+10d

South Carolina State AG+16d

Pattern: first filing Nov 29 (MA), last Dec 15 (SC) — a 16-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA3188.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 29, 2021
Raw hash: 847a11179ec71745147c691dc385fdee3d232399d30ae25c78958aad7ed311e6

Linked disclosures

Regulatory filings (7) · sorted by filing gap

Reporting entityDNA Diagnostics Center, Inc.

Victim entityDNA Diagnostics Center, Inc.

Incidentdiscovered Aug 6, 2021

Stated responseOpened an investigation

ComplianceWA AG >90d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com