PhysicalHealthcareHealthcareLossEmployee Data InvolvedGovernment IDIdentity (basic)MediumActive

KAISER FOUNDATION HEALTH PLAN, INC.

bd_620e9a5ff7cdce60 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 26, 2011

Filed

Mar 16, 2012

To disclose

25 weeks

Affected

Not disclosed

Confidence

66%

Full breach record for KAISER FOUNDATION HEALTH PLAN, INC. →15 incidents on file

Kaiser Foundation Health Plan disclosed a breach of confidential employee information found on a non-Kaiser Permanente external hard drive purchased second-hand. The data included names, Social Security Numbers, dates of birth, and addresses. The breach was brought to attention in late September 2011. The investigation is ongoing. One year of credit monitoring is being provided.

J jump to incidentP pin to compareR raw source

California clockDiscovered Sep 26, 2011 → Notified Mar 1, 2012157d ✗ CA 60-day late25 weeks discovery → filing

Incident timeline

discovery → filing · 25 weeks / 172 days

Sep 26, 2011

Discovered

Mar 16, 2012

Filed

vs. sector median

+12 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: KAISER FOUNDATION HEALTH PLAN, INC.
norm: kaiser foundation health plan
Domain: healthy.kaiserpermanente.org

Name: KAISER FOUNDATION HEALTH PLAN, INC.
norm: kaiser foundation health plan
Domain: healthy.kaiserpermanente.org
Industry: Healthcarellm

Discovered: Sep 26, 2011
Materiality determined: —
Notification sent: Mar 1, 2012
Affected individuals: Not disclosed
Data types: Government IDIdentity (basic)
Attack vector: Unknown
MITRE ATT&CK: T1052 Exfiltration Over Physical Medium
Regulator citations: Notified law enforcement

During the incident: Immediately took steps to get possession of the equipment
Notified law enforcement
Began our own investigation
Identified the internal source of the data found on the hard drive
Providing one year of professional credit monitoring at Kaiser Permanente’s expense
Changes made: Taking appropriate steps to make sure that it does not happen again
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 25 weeks(172 days from discovery to filing)
Compliance flags: CA 60-day late · 157d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Sep 26, 2011
→ Notified: Mar 1, 2012
157d 60 days (analyst band, pre-2026 discoveries) CA 60-day late

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Sep 26, 2011 → Notified: Mar 1, 2012	157d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-22724
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 16, 2012
Raw hash: f8df17e9739a2acd8bb2498c8a15ad6ffeef577df04c5116ccbc705b0127d353

Reporting entityKAISER FOUNDATION HEALTH PLAN, INC.

Victim entityKAISER FOUNDATION HEALTH PLAN, INC.

Incidentdiscovered Sep 26, 2011

Stated responseImmediately took steps to get possession of the equipment

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov