HackingStolen CredentialsData ExfiltratedCustomer Data InvolvedDelayed DiscoveryPIIIDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTFINANCIAL_CREDENTIALSHEALTH_BASICPHIMediumContained
Imperial Beach Community Clinic
bd_767a4e75a132e7df · schema v1 · pii pii-v1
Full breach record for Imperial Beach Community Clinic →Imperial Beach Community Clinic notified patients of a data breach where an unauthorized individual copied information between Feb 4 and May 2, 2025. The clinic became aware of unusual email activity on April 15, 2025. Affected data may include names, SSNs, health info, and financial data. The clinic engaged forensic investigators and is providing 12 months of credit monitoring and fraud assistance to affected individuals.
California clockDiscovered Apr 15, 2025 → Notified Jan 6, 2026266d ✗ CA 60-day late38 weeks discovery → filing
Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-616618
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jan 6, 2026
- Raw hash
- aa191be24f9b71f5cdfd040a792adb17b33658d2e4d5e9ad5e06faeaf3663acf
Reporting entity
- Name
- Imperial Beach Community Clinicnorm: imperial beach community clinic
Victim entity
- Name
- Imperial Beach Community Clinicnorm: imperial beach community clinic
Incident
- Discovered
- Apr 15, 2025
- Materiality determined
- —
- Notification sent
- Jan 6, 2026
- Affected individuals
- Not disclosed
- Data types
- PIIIDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTFINANCIAL_CREDENTIALSHEALTH_BASICPHI
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1078 Valid AccountsT1114 Email CollectionT1041 Exfiltration Over C2 Channel
- Threat actor
- External
- Regulator citations
- Notified California Attorney General
- Initial access
- valid_credentials
Compliance
- Time to disclose
- 38 weeks(266 days from discovery to filing)
- Compliance flags
- CA 60-day late · 266dCA AG copy ≤15d · 0d
- Discovery-date grounding
- letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Apr 15, 2025→ Notified: Jan 6, 2026266d 60 days (analyst band, pre-2026 discoveries) CA 60-day late California Consumers notified: Jan 6, 2026→ AG copy submitted: Jan 6, 20260d 15 calendar days CA AG copy ≤15d
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.