UnknownHealthcareHealthcareCustomer Data InvolvedEmployee Data InvolvedPHIGovernment IDIdentity (basic)Health (basic)Financial accountMediumContained

Hand & Upper Extremity Centers

bd_63ce212c2d458622 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 5, 2017

Filed

Sep 1, 2017

To disclose

8 weeks

Affected

Not disclosed

Linked

4 filings

Confidence

66%

Full breach record for Hand & Upper Extremity Centers →

Hand Rehabilitation Specialists notified individuals of a potential data breach discovered on July 5, 2017. Unauthorized access to the network could not be ruled out, though no evidence of data exfiltration was found. Affected data may include names, SSNs, dates of birth, addresses, phone numbers, diagnoses, and insurance information. The organization engaged forensic investigators and law enforcement (Ventura County Sheriff’s Office, FBI) and offered credit monitoring services.

J jump to incidentP pin to compareR raw source

California clockDiscovered Jul 5, 2017 → Notified Sep 1, 201758d ✓ CA 60-day OK8 weeks discovery → filing

Incident timeline

discovery → filing · 8 weeks / 58 days

Jul 5, 2017

Discovered

Sep 1, 2017

Filed

vs. sector median

3 wks faster

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

HHS OCRthe Dark Overlordbd_22d1640b67afe0bc2017-09-01Verified
New Hampshire State AGbd_bbe76375b55cb59e2017-08-30 · +2dVerified
Massachusetts State AGbd_c3f0f8c0feafa2882017-08-30 · +2dVerified

Name: Hand & Upper Extremity Centers
norm: hand upper extremity centers

Name: Hand & Upper Extremity Centers
norm: hand upper extremity centers
Also named: Hand & Upper Extremity Centersdba oflegal entity
Hand Rehabilitation Specialistsdba oftrade name
Industry: Healthcarellm

Discovered: Jul 5, 2017
Materiality determined: —
Notification sent: Sep 1, 2017
Affected individuals: Not disclosed
Data types: PHIGovernment IDIdentity (basic)Health (basic)Financial account
Data elements: Social Security numberDate of birthMedical information
Attack vector: Unknown
Regulator citations: Reported to Ventura County Sheriff’s OfficeConsultation with the FBINotified applicable state agencies

During the incident: Reported the notice to the Ventura County Sheriff’s Office
Began a prompt forensic IT investigation in consultation with the FBI
Notified and have been working with outside IT consultants
Notified applicable state agencies
Reviewing security policies and procedures
Offering identity theft protection services through ID Experts
Changes made: Reviewing security policies and procedures to ensure all appropriate steps have been taken
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(58 days from discovery to filing)
Compliance flags: CA 60-day OK · 58d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Jul 5, 2017
→ Notified: Sep 1, 2017
58d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Jul 5, 2017 → Notified: Sep 1, 2017	58d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 3 states

View merged incident ↗

New Hampshire State AGAug 30 · first

Massachusetts State AGAug 30 · first

HHS OCR+2d

California State AG+2d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-101589
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 1, 2017
Raw hash: 200d821aa822a579ca8025cc0a2bb9272eb5f0df93ad3fd99b6e4cd2f922ff70

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityHand & Upper Extremity Centers

Victim entityHand & Upper Extremity Centers

Incidentdiscovered Jul 5, 2017

Stated responseReported the notice to the Ventura County Sheriff’s Office

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov