AccidentalHealthcareHealthcareMisdeliveryCustomer Data InvolvedIdentity (basic)MetadataBehaviorLocationLowResolved

KAISER FOUNDATION HEALTH PLAN, INC.

bd_6df8e8fd95107a35 · schema v1 · pii pii-v1

Severity

Low

Discovered

Oct 25, 2023

Filed

Apr 12, 2024

To disclose

24 weeks

Affected

Not disclosed

Linked

3 filings

Confidence

65%

Full breach record for KAISER FOUNDATION HEALTH PLAN, INC. →15 incidents on file

Kaiser Permanente disclosed that cookies/pixels on its websites and apps may have transmitted member personal information (IP address, name, account status, navigation data, search terms) to third-party vendors Google, Microsoft Bing, and X (Twitter). Credentials, SSNs, and financial data were not involved. The technologies were removed following an internal investigation.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 24 weeks / 170 days

Oct 25, 2023

Discovered

Apr 12, 2024

Filed

vs. sector median

+12 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

HHS OCRbd_35c97dbc0b1600c12024-04-12Verified
Oregon State AGbd_c5cf4b16fb2197ab2024-04-12Verified

Name: KAISER FOUNDATION HEALTH PLAN, INC.
norm: kaiser foundation health plan
Domain: healthy.kaiserpermanente.org

Name: KAISER FOUNDATION HEALTH PLAN, INC.
norm: kaiser foundation health plan
Domain: healthy.kaiserpermanente.org
Industry: Healthcarellm

Discovered: Oct 25, 2023
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Identity (basic)MetadataBehaviorLocation
Attack vector: Misconfiguration

During the incident: Conducted a voluntary internal investigation into the use of these online technologies
Removed these online technologies from our websites and mobile applications
Changes made: Implemented additional measures with the guidance of experts to safeguard against recurrence of this type of incident
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 24 weeks(170 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 2 states

View merged incident ↗

HHS OCRApr 12 · first

Oregon State AGApr 12 · first

California State AGApr 12 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-583875
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 12, 2024
Raw hash: 9d6df8bc4168ed2a26968550890377543950528341c49be8b561b8e9b814e999

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityKAISER FOUNDATION HEALTH PLAN, INC.

Victim entityKAISER FOUNDATION HEALTH PLAN, INC.

Incidentdiscovered Oct 25, 2023

Stated responseConducted a voluntary internal investigation into the use of these online technologies

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov