HackingData ExfiltratedCustomer Data InvolvedPHIHEALTH_BASICIDENTITY_BASICFINANCIAL_ACCOUNTLowContained
EpiSource
bd_62e71d1149df6ffb · schema v1 · pii pii-v1
Full breach record for EpiSource →Episource, LLC reported a data breach where a criminal accessed and copied data from its computer systems between January 27, 2025, and February 6, 2025. The incident was discovered on February 6, 2025. Affected data includes contact information, health insurance data, health data (diagnoses, treatments), and other personal data such as date of birth. Episource engaged a special investigation team, notified law enforcement, and shut down impacted systems. It is offering two years of credit monitoring and identity theft protection to affected individuals.
California clockDiscovered Feb 6, 2025 → Notified Sep 11, 2025217d ✗ CA 60-day late31 weeks discovery → filing
This filing is one of 3 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (2) · sorted by filing gap
- bd_a2b82676192bff45New Hampshire State AGfiled 2025-09-15(4d gap)Verified
- bd_86be71a38f1e4e1dNew Hampshire State AGfiled 2025-07-14(59d gap)Candidate
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-608441
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Sep 11, 2025
- Raw hash
- cef37b10560051d251416bb44c58d18a58ea7ce637ad817dac05989f09c30909
Reporting entity
- Name
- EpiSourcenorm: episource
Victim entity
- Name
- EpiSourcenorm: episource
Incident
- Discovered
- Feb 6, 2025
- Materiality determined
- —
- Notification sent
- Sep 11, 2025
- Affected individuals
- Not disclosed
- Data types
- PHIHEALTH_BASICIDENTITY_BASICFINANCIAL_ACCOUNT
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
- Threat actor
- External
Compliance
- Time to disclose
- 31 weeks(217 days from discovery to filing)
- Compliance flags
- CA 60-day late · 217d
- Discovery-date grounding
- letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Feb 6, 2025→ Notified: Sep 11, 2025217d 60 days (analyst band, pre-2026 discoveries) CA 60-day late
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.