Social EngineeringHealthcareTechnologyHealthcarePhishingCustomer Data InvolvedEmployee Data InvolvedPIIIdentity (basic)Government IDHealth (basic)MediumContained

TANDEM DIABETES CARE, INC.

bd_6c63dab2a1b5df4d · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 17, 2020

Filed

Mar 17, 2020

To disclose

9 weeks

Affected

815state residents only

Linked

6 filings

Confidence

66%

Full breach record for TANDEM DIABETES CARE, INC. →

Tandem Diabetes Care notified affected individuals of a phishing incident on Jan 17, 2020, where unauthorized access to employee email accounts exposed names, SSNs, and clinical diabetes data. The company secured accounts, engaged forensic investigators, and offered credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 9 weeks / 60 days

Jan 17, 2020

Begins

Jan 17, 2020

Discovered

Mar 17, 2020

Filed

vs. sector median

on median

This filing is one of 6 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Massachusetts State AGbd_06fe92128ee5892a2020-03-17Verified
HHS OCRbd_115a67d17b94defa2020-03-17Verified
Oregon State AGbd_4a5f61e0d367ccc72020-03-17Verified
California State AGbd_967313c2bc1de98b2020-03-17Verified

Show 1 more filing ↓up to 76d gap

Illinois State AGbd_d70147b6456449fa2020-01-01 · +76dCandidate

Name: TANDEM DIABETES CARE, INC.
norm: tandem diabetes care

Name: TANDEM DIABETES CARE, INC.
norm: tandem diabetes care
Industry: HealthcarellmTechnologyllm

Discovered: Jan 17, 2020
Breach occurred: Jan 17, 2020 – Jan 20, 2020
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 815state-resident count only
Data types: PIIIdentity (basic)Government IDHealth (basic)
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing Link
Threat actor: External
Initial access: phishing_link

During the incident: Secured the account
Engaged a cyber security firm to assist in our investigation
Offering you a complimentary one-year membership of Experian’s IdentityWorks Credit 3B
Changes made: Implementing additional email security controls
Strengthening our user authorization and authentication processes
Limiting the types of data permitted to be transferred via email
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(60 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 5 states

View merged incident ↗

Illinois State AGJan 1 · first

Massachusetts State AG+76d

HHS OCR+76d

Oregon State AG+76d

California State AG+76d

Montana State AG+76d · this page

Pattern: first filing Jan 1 (IL), last Mar 17 (MT) — a 76-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Breach-NotificationDetails-139.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 17, 2020
Raw hash: 298ef7bc0870959cff6f7d29de1409fa7a00e05968abc77ad06939fdc495aa99

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityTANDEM DIABETES CARE, INC.

Victim entityTANDEM DIABETES CARE, INC.

Incidentdiscovered Jan 17, 2020

Stated responseSecured the account

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov