PhysicalTheftCustomer Data InvolvedIDENTITY_BASICIDENTITY_GOVERNMENTHEALTH_BASICMediumActive
Exceltox Laboratories
bd_7d907f653a415558 · schema v1 · pii pii-v1
Full breach record for Exceltox Laboratories →Exceltox Laboratories, LLC, a clinical laboratory, reported a data breach involving a missing UPS package containing COVID-19 test records. The package, sent on February 15, 2021, to a document scanning vendor, was never delivered. Records included names, SSNs, DOBs, and medical data. Exceltox notified HHS, reset passwords, and offered 12 months of Experian IdentityWorks. The package remains missing as of the notice date of May 7, 2021.
California clockDiscovered May 7, 2021 → Notified May 7, 20210d ✓ CA 60-day OK≤1 day discovery → filing
⚠ notification dateThe stored discovery date equals the NOTIFICATION date, collapsing the clock to ~zero. This UNDERSTATES the delay and can mask a real violation.
This filing is one of 2 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (1) · sorted by filing gap
- bd_79248a18ffd9c54eHHS OCRfiled 2021-05-07Candidate
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-540660
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- May 7, 2021
- Raw hash
- 835996e462b8c3b214865f8c8a5d83251a4617cea82f267f70d58e633d12b023
Reporting entity
- Name
- Exceltox Laboratoriesnorm: exceltox laboratories
Victim entity
- Name
- Exceltox Laboratoriesnorm: exceltox laboratories
Incident
- Discovered
- May 7, 2021
- Materiality determined
- —
- Notification sent
- May 7, 2021
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENTHEALTH_BASIC
- Attack vector
- Unknown
- MITRE ATT&CK
- T1052 Exfiltration Over Physical Medium
- Regulator citations
- Notified the Department of Health and Human Services
Compliance
- Time to disclose
- ≤1 day(0 days from discovery to filing)
- Compliance flags
- CA 60-day OK · 0d
- Discovery-date grounding
- notification dateThe stored discovery date equals the NOTIFICATION date, collapsing the clock to ~zero. This UNDERSTATES the delay and can mask a real violation.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: May 7, 2021→ Notified: May 7, 20210d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.