HackingData ExfiltratedCustomer Data InvolvedDelayed DiscoveryIDENTITY_GOVERNMENTIDENTITY_BASICHEALTH_BASICFINANCIAL_ACCOUNTMediumContained
21st Century Oncology
bd_71143f2f3db9e047 · schema v1 · pii pii-v1
Full breach record for 21st Century Oncology →21st Century Oncology notified California AG in 2016 regarding a 2015 breach. An unauthorized third party accessed a database containing patient names, SSNs, diagnoses, and insurance info starting Oct 3, 2015. FBI advised on Nov 13, 2015. Notification was delayed per FBI request. Affected individuals received one year of Experian ProtectMyID.
California clockDiscovered Nov 13, 2015 → Notified Jul 7, 2016237d ✗ CA 60-day late16 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
This filing is one of 4 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (3) · sorted by filing gap
- bd_231b0f2f48d86b56Washington State AGfiled 2016-03-04Verified
- bd_fcbda5a17a2f0c7eHHS OCRfiled 2016-03-04Verified
- bd_f97670eab77986b1Montana State AGfiled 2016-03-14(10d gap)Verified by operator
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-60307
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Mar 4, 2016
- Raw hash
- 80663ea127ef9b5fccd9463c8a46b8c9e2036596681a5f84f696aa4a9d8d4678
Reporting entity
- Name
- 21st Century Oncologynorm: 21st century oncology
- Domain
- 21co.com
Victim entity
- Name
- 21st Century Oncologynorm: 21st century oncology
- Domain
- 21co.com
Incident
- Discovered
- Nov 13, 2015
- Materiality determined
- —
- Notification sent
- Jul 7, 2016
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_GOVERNMENTIDENTITY_BASICHEALTH_BASICFINANCIAL_ACCOUNT
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1190 Exploit Public-Facing Application
- Threat actor
- ExternalFinancial
- Regulator citations
- Federal Bureau of Investigation (FBI) advised us that patient information was illegally obtained
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 16 weeks(112 days from discovery to filing)
- Compliance flags
- CA 60-day late · 237d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Nov 13, 2015→ Notified: Jul 7, 2016237d 60 days (analyst band, pre-2026 discoveries) CA 60-day late
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.