HackingHealthcareTechnologyHealthcareData ExfiltratedCustomer Data InvolvedIdentity (basic)LowContained

Biolase, Inc.

bd_5ffd779b34e4d358 · schema v1 · pii pii-v1

Severity

Low

Discovered

Dec 29, 2021

Filed

Aug 11, 2022

To disclose

32 weeks

Affected

Not disclosed

Linked

7 filings

Confidence

65%

Full breach record for Biolase, Inc. →2 incidents on file

Biolase, Inc. disclosed that an unauthorized actor accessed its network and removed files between December 21 and December 29, 2021. The company identified unusual activity on December 29, 2021, and engaged third-party forensic specialists. The incident potentially affected individuals' names and other personal information. Biolase notified law enforcement and regulatory authorities, and offered credit monitoring services via Equifax. The investigation was completed by July 12, 2022.

J jump to incidentP pin to compareR raw source

California clockDiscovered Dec 29, 2021 → Notified Jul 12, 2022195d ✗ CA 60-day late32 weeks discovery → filing

Incident timeline

undetected · 8 days

discovery → filing · 32 weeks / 225 days

Dec 21, 2021

Begins

Dec 29, 2021

Discovered

Aug 11, 2022

Filed

vs. sector median

+20 wks slower

This filing is one of 7 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

Maine State AGbd_b2a298ec52612bbf2022-08-11Verified
Massachusetts State AGbd_040f72903f640be32022-05-23 · +80dVerified
California State AGbd_8a23b7ea9882179a2022-05-23 · +80dVerified
Maine State AGbd_cfd3f06d2115248f2022-05-23 · +80dVerified

Show 2 more filings ↓up to 83d gap

Montana State AGbd_58bcdcef0e89ee482022-05-20 · +83dCandidate
Indiana State AGbd_aa1fb199a18b36132022-05-20 · +83dVerified

Name: Biolase, Inc.
norm: biolase
Domain: biolase.com

Name: Biolase, Inc.
norm: biolase
Domain: biolase.com
Industry: HealthcarellmTechnologyllm

Discovered: Dec 29, 2021
Breach occurred: Dec 21, 2021 – Dec 29, 2021
Undetected for: 8 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 12, 2022
Affected individuals: Not disclosed
Data types: Identity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1041 Exfiltration Over C2 Channel
Threat actor: External
Regulator citations: Notifying regulatory authorities as required by law

During the incident: Launched an in-depth investigation with the assistance of third-party forensic specialists
Notified law enforcement
Notifying regulatory authorities as required by law
Arranged to have Equifax provide credit monitoring services at no cost
Changes made: Reviewing existing policies and procedures
Implementing additional safeguards to further secure the information in our systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 32 weeks(225 days from discovery to filing)
Compliance flags: CA 60-day late · 195d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Dec 29, 2021
→ Notified: Jul 12, 2022
195d 60 days (analyst band, pre-2026 discoveries) CA 60-day late

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Dec 29, 2021 → Notified: Jul 12, 2022	195d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 5 states

View merged incident ↗

Montana State AGMay 20 · first

Indiana State AGMay 20 · first

Massachusetts State AG+3d

California State AG+3d

Maine State AG+3d

Maine State AG+83d

California State AG+83d · this page

Pattern: first filing May 20 (MT), last Aug 11 (CA) — a 83-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-556160
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 11, 2022
Raw hash: 65310b2216fc32a1dcd1ef22a914c734fa11f4deb6d3e822cd35cccb9291ee03

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityBiolase, Inc.

Victim entityBiolase, Inc.

Incidentdiscovered Dec 29, 2021

Stated responseLaunched an in-depth investigation with the assistance of third-party forensic specialists

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov