HackingHealthcareHealthcareData ExfiltratedCustomer Data InvolvedDelayed DiscoveryPHIIdentity (basic)Government IDFinancial accountHealth (basic)BiometricCredentialsMediumContained

Palomar Health Medical Group

bd_618e29d3094b64b0 · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 5, 2024

Filed

Oct 15, 2025

To disclose

18 months

Affected

Not disclosed

Confidence

65%

Full breach record for Palomar Health Medical Group →3 incidents on file

Palomar Health Medical Group (PHMG) reported that an unauthorized actor gained access to certain files on its network from April 23, 2024, to May 5, 2024, and may have copied them. PHMG identified suspicious activity on May 5, 2024. The incident potentially impacted patient information including names, SSNs, health records, financial account info, and biometric data. PHMG notified law enforcement, enhanced security protocols, and offered credit monitoring. The notice was reissued in October 2025 to individuals who may not have previously received it.

J jump to incidentP pin to compareR raw source

California clockDiscovered May 5, 2024 → Notified Oct 15, 2025528d ✗ CA 60-day late18 months discovery → filing

Incident timeline

undetected · 12 days

discovery → filing · 18 months / 528 days

Apr 23, 2024

Begins

May 5, 2024

Discovered

Oct 15, 2025

Filed

vs. sector median

+63 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: Palomar Health Medical Group
norm: palomar health medical
Domain: palomarhealthmedicalgroup.org

Name: Palomar Health Medical Group
norm: palomar health medical
Domain: palomarhealthmedicalgroup.org
Industry: Healthcarellm

Discovered: May 5, 2024
Breach occurred: Apr 23, 2024 – May 5, 2024
Undetected for: 12 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 15, 2025
Affected individuals: Not disclosed
Data types: PHIIdentity (basic)Government IDFinancial accountHealth (basic)BiometricCredentials
Data elements: Social Security numberDate of birthMedical information
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
Threat actor: External
Regulator citations: Notified applicable state and federal regulators

During the incident: Launched an investigation to determine the nature and scope of the activity
Took prompt steps to ensure security of its network environment
Notified law enforcement
Conducted a comprehensive review of the information potentially affected
Providing access to complimentary credit monitoring and identity restoration services through Experian
Notifying applicable state and federal regulators
Notifying consumer reporting agencies
Changes made: Enhanced its existing security protocols
Continues to evaluate its policies and procedures related to data privacy and security
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 18 months(528 days from discovery to filing)
Compliance flags: CA 60-day late · 528d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: May 5, 2024
→ Notified: Oct 15, 2025
528d 60 days (analyst band, pre-2026 discoveries) CA 60-day late

Statute	Window	Elapsed	Threshold	Status
California	Discovered: May 5, 2024 → Notified: Oct 15, 2025	528d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-612839
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 15, 2025
Raw hash: 197a75ffbb3e2157ccf737be0b7bc3c537393197582592da8ad60365e1a08d23

Reporting entityPalomar Health Medical Group

Victim entityPalomar Health Medical Group

Incidentdiscovered May 5, 2024

Stated responseLaunched an investigation to determine the nature and scope of the activity

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov