MisuseHealthcareHealthcarePrivilege AbuseEmployee Data InvolvedCustomer Data InvolvedIdentity (basic)PHIHealth (basic)LowActive

Mellow

bd_714778106e4fb93b · schema v1 · pii pii-v1

Severity

Low

Discovered

Jan 3, 2024

Filed

Jan 3, 2024

To disclose

≤1 day

Affected

Not disclosed

Confidence

66%

Full breach record for Mellow →

Mellow Massage Hollywood disclosed an insider breach involving a former employee who unauthorizedly accessed and texted patient contact information (name, email, phone) from his new practice. The incident was discovered on January 3, 2024, when patients reported receiving texts from the former provider. The organization confirmed that payment information was not accessed, but potential exposure of personal medical files is under investigation. Law enforcement has been notified.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · ≤1 day / 0 days

Jan 3, 2024

Discovered

Jan 3, 2024

Filed

vs. sector median

13 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: Mellow
norm: mellow
Domain: mellow-massage.com

Name: Mellow
norm: mellow
Domain: mellow-massage.com
Industry: Healthcarellm

Discovered: Jan 3, 2024
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Identity (basic)PHIHealth (basic)
Attack vector: Insider
Threat actor: Internal
Regulator citations: Contacting state and federal authorities
Initial access: insider_action

During the incident: Contacting state and federal authorities
Working with law enforcement
Notifying the party that appears to have unlawfully accessed your information
Demanding an immediate cessation of their activities relating to the use of your information
Demanding a full disclosure of all information acquired
Assessing if your data was shared, sold to, or otherwise provided to third parties
Source: Quoted from the filing itself, not independently verified.

Time to disclose: ≤1 day(0 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-578784
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 3, 2024
Raw hash: f33c68d5137aefbe4883d7539d3935b2ede4c5a0525aa054ae3d083bdb033128

Reporting entityMellow

Victim entityMellow

Incidentdiscovered Jan 3, 2024

Stated responseContacting state and federal authorities

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov