MalwareHealthcareHealthcareRansomwareData EncryptedCustomer Data InvolvedPHIHealth (basic)Identity (basic)LowContained

Granite Wellness Centers

bd_66aa8648648a64f5 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jan 5, 2021

Filed

Feb 4, 2021

To disclose

4 weeks

Affected

Not disclosed

Linked

2 filings

Confidence

65%

Full breach record for Granite Wellness Centers →

Granite Wellness Centers experienced a ransomware attack discovered on January 5, 2021, which encrypted data on their servers. The incident affected client personal information including full name, date of birth, dates of care, treatment/health information, treatment provider, and health insurer. The organization took affected systems offline, reported to law enforcement, and restored systems from backups. No actual misuse of personal information was known.

J jump to incidentP pin to compareR raw source

California clockDiscovered Jan 5, 2021 → Notified Jan 28, 202123d ✓ CA 60-day OK4 weeks discovery → filing

Incident timeline

discovery → filing · 4 weeks / 30 days

Jan 5, 2021

Discovered

Feb 4, 2021

Filed

vs. sector median

8 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

HHS OCRbd_557c4abf43138aa02021-02-04Candidate

Name: Granite Wellness Centers
norm: granite wellness centers

Name: Granite Wellness Centers
norm: granite wellness centers
Industry: Healthcarellm

Discovered: Jan 5, 2021
Materiality determined: —
Notification sent: Jan 28, 2021
Affected individuals: Not disclosed
Data types: PHIHealth (basic)Identity (basic)
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for Impact
Threat actor: ExternalFinancial
Regulator citations: Notifying state and federal regulators, as required

During the incident: Took the affected systems offline
Reported the incident to law enforcement
Began to assess the incident, to eliminate the ransomware, and to take measures to restore our systems and prevent further attacks
Restored our systems from back-up files
Rebuilding the affected systems
Implementing additional safeguards to further secure the information in our systems
Notifying state and federal regulators, as required
Changes made: Rebuilding the affected systems
Implementing additional safeguards to further secure the information in our systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 4 weeks(30 days from discovery to filing)
Compliance flags: CA 60-day OK · 23d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Jan 5, 2021
→ Notified: Jan 28, 2021
23d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Jan 5, 2021 → Notified: Jan 28, 2021	23d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings

View merged incident ↗

HHS OCRFeb 4 · first

California State AGFeb 4 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-537752
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 4, 2021
Raw hash: 5a5238776dfb7533117ff2648b9521dd6a206f3cbbdb9c4123d3ad99206b50f6

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityGranite Wellness Centers

Victim entityGranite Wellness Centers

Incidentdiscovered Jan 5, 2021

Stated responseTook the affected systems offline

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov