MalwareHealthcareHealthcareRansomwareData ExfiltratedData EncryptedCustomer Data InvolvedIdentity (basic)Government IDPHIHealth (basic)FinancialMediumContained

Restorative Arts Physical Therapy, Inc.

bd_841afcb7032a641f · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 29, 2022

Filed

Oct 28, 2022

To disclose

9 weeks

Affected

Not disclosed

Linked

2 filings

Confidence

64%

Full breach record for Restorative Arts Physical Therapy, Inc. →

Restorative Arts Physical Therapy, Inc. d/b/a Core Conditioning notified the California Attorney General of a data breach discovered on August 29, 2022. Data on servers was encrypted and inaccessible. An unauthorized third party obtained personal information including names, addresses, SSNs, driver's license numbers, and medical/health insurance information. The company engaged forensic experts and offered one year of Experian IdentityWorks credit monitoring to affected individuals.

J jump to incidentP pin to compareR raw source

California clockDiscovered Aug 29, 2022 → Notified Oct 28, 202260d ✓ CA 60-day OK9 weeks discovery → filing

Incident timeline

discovery → filing · 9 weeks / 60 days

Aug 29, 2022

Begins

Aug 29, 2022

Discovered

Oct 28, 2022

Filed

vs. sector median

on median

This filing is one of 2 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

HHS OCRbd_5e87094fbc3be97f2022-10-28Verified

Name: Restorative Arts Physical Therapy, Inc.
norm: restorative arts physical therapy

Name: Restorative Arts Physical Therapy, Inc.
norm: restorative arts physical therapy
Also named: Restorative Arts Physical Therapy, Inc.dba oflegal entity
Core Conditioningdba oftrade name
Industry: Healthcarellm

Discovered: Aug 29, 2022
Breach occurred: Aug 29, 2022
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 28, 2022
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDPHIHealth (basic)Financial
Data elements: Social Security numberDate of birthMedical information
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial

During the incident: Worked with forensic security experts to investigate the incident
Arranged for a complimentary one-year membership of Experian IdentityWorks Credit 3B
Reviewing our technical security measures to assess changes that can be made to reduce the risk of a similar incident from occurring in the future
Changes made: Reviewing our technical security measures to assess changes that can be made to reduce the risk of a similar incident from occurring in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(60 days from discovery to filing)
Compliance flags: CA 60-day OK · 60d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Aug 29, 2022
→ Notified: Oct 28, 2022
60d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Aug 29, 2022 → Notified: Oct 28, 2022	60d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings

View merged incident ↗

HHS OCROct 28 · first

California State AGOct 28 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-558722
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 28, 2022
Raw hash: 936e27a25e7ed4cc0285cf19a562530f40c6467fd8b21d8cde9b418ddceb9ab9

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityRestorative Arts Physical Therapy, Inc.

Victim entityRestorative Arts Physical Therapy, Inc.

Incidentdiscovered Aug 29, 2022

Stated responseWorked with forensic security experts to investigate the incident

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov