HackingHealthcareHealthcareStolen CredentialsSupply Chain (3P Vendor)Customer Data InvolvedDelayed DiscoveryPHIIdentity (basic)Government IDHealth (basic)MediumContained

Bay Children

bd_70aa23ee76a5bd98 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 1, 2016

Filed

May 5, 2016

To disclose

5 weeks

Affected

Not disclosed

Confidence

63%

Full breach record for Bay Children →

Bay Area Children's Association notified patients that their electronic medical record provider suffered a breach. Intruders installed malware in January 2015 and used stolen credentials to access systems. BACA learned of the incident on April 1, 2016. Affected data may include names, addresses, SSNs, and health information. Free credit monitoring was provided.

J jump to incidentP pin to compareR raw source

California clockDiscovered Apr 1, 2016 → Notified May 6, 201635d ✓ CA 60-day OK5 weeks discovery → filing

Incident timeline

undetected · 456 days

discovery → filing · 5 weeks / 34 days

Jan 1, 2015

Begins

Apr 1, 2016

Discovered

May 5, 2016

Filed

vs. sector median

7 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: Bay Children
norm: bay children
Domain: baychildren.org

Name: Bay Children
norm: bay children
Domain: baychildren.org
Industry: Healthcarellm

Discovered: Apr 1, 2016
Breach occurred: Jan 1, 2015 – Jan 31, 2015
Undetected for: 456 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 6, 2016
Affected individuals: Not disclosed
Data types: PHIIdentity (basic)Government IDHealth (basic)
Data elements: Date of birth
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid AccountsT1195 Supply Chain Compromise
Threat actor: External
Regulator citations: FBI and Secret Service have been investigating this matterU.S. Attorney's Office is now involved in the investigation
Third party: via electronic medical record provider
Initial access: supply_chain

During the incident: Notifying you of the breach
Providing free credit monitoring to you for 12 months
FBI and Secret Service have been investigating this matter
U.S. Attorney's Office is now involved in the investigation
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(34 days from discovery to filing)
Compliance flags: CA 60-day OK · 35d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Apr 1, 2016
→ Notified: May 6, 2016
35d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Apr 1, 2016 → Notified: May 6, 2016	35d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-61688
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 5, 2016
Raw hash: 5a5ba837a0507f3288f2fba175f730c511c8823ceca98e4ee1c653da0bc24853

Reporting entityBay Children

Victim entityBay Children

Incidentdiscovered Apr 1, 2016

Stated responseNotifying you of the breach

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov