PhysicalRetail & ConsumerHealthcareRetailTheftCustomer Data InvolvedPHIHealth (basic)Identity (basic)LowContained

Raley's/Bel Air Mart/Nob Hill General Store, Inc.

bd_828fde29bb609674 · schema v1 · pii pii-v1

Severity

Low

Discovered

Sep 24, 2018

Filed

Oct 26, 2018

To disclose

5 weeks

Affected

Not disclosed

Linked

2 filings

Confidence

63%

Full breach record for Raley's/Bel Air Mart/Nob Hill General Store, Inc. →

Raley's/Bel Air Mart/Nob Hill General Store, Inc. reported the theft of a pharmacy laptop on September 24, 2018. The device contained unencrypted electronic files with personal health information (PHI) for pharmacy patients, including names, dates of birth, health plans, medical conditions, and prescription drugs. The data did not contain SSNs, addresses, or credit card numbers. The company notified law enforcement, investigated the incident, and subsequently encrypted all pharmacy laptops.

J jump to incidentP pin to compareR raw source

California clockDiscovered Sep 24, 2018 → Notified Oct 26, 201832d ✓ CA 60-day OK5 weeks discovery → filing

Incident timeline

discovery → filing · 5 weeks / 32 days

Sep 24, 2018

Begins

Sep 24, 2018

Discovered

Oct 26, 2018

Filed

vs. sector median

3 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

HHS OCRbd_ae8054ad5dcbcba92018-10-26Candidate

Name: Raley's/Bel Air Mart/Nob Hill General Store, Inc.
norm: raley s bel air mart nob hill general store

Name: Raley's/Bel Air Mart/Nob Hill General Store, Inc.
norm: raley s bel air mart nob hill general store
Industry: Retail & ConsumerllmHealthcarellm

Discovered: Sep 24, 2018
Breach occurred: Sep 24, 2018
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 26, 2018
Affected individuals: Not disclosed
Data types: PHIHealth (basic)Identity (basic)
Attack vector: Unknown
MITRE ATT&CK: T1052 Exfiltration Over Physical Medium
Threat actor: External

During the incident: Notified law enforcement of the theft
Interviewed employees with access to the laptop to understand potential content
Examined emails received by those employees with links to download files that may have been temporarily downloaded to cache files on the laptop
Changes made: Encrypted all pharmacy laptops
Continually reinforcing existing policies and practices
Evaluating additional safeguards to prevent this type of incident from occurring in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(32 days from discovery to filing)
Compliance flags: CA 60-day OK · 32d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Sep 24, 2018
→ Notified: Oct 26, 2018
32d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Sep 24, 2018 → Notified: Oct 26, 2018	32d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings

View merged incident ↗

HHS OCROct 26 · first

California State AGOct 26 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-141169
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 26, 2018
Raw hash: 2c926eae2572f8a10a4e683c84e4e22bb9af7143abbe6e6819464913cc94b4a3

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityRaley's/Bel Air Mart/Nob Hill General Store, Inc.

Victim entityRaley's/Bel Air Mart/Nob Hill General Store, Inc.

Incidentdiscovered Sep 24, 2018

Stated responseNotified law enforcement of the theft

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov