HackingHealthcareHealthcareStolen CredentialsCustomer Data InvolvedDelayed DiscoveryPHIHealth (basic)Financial accountIdentity (basic)LowContained

Hamel Cranial Chiropractic & Wellness INC.

bd_8907d26f36368d1b · schema v1 · pii pii-v1

Severity

Low

Discovered

Aug 26, 2024

Filed

Sep 11, 2024

To disclose

16 days

Affected

Not disclosed

Confidence

63%

Full breach record for Hamel Cranial Chiropractic & Wellness INC. →

Hamel Cranial Chiropractic & Wellness INC. experienced unauthorized access to its business software on August 4, 2024. The malicious actor logged in and created a fake deposit bank account. Patient medical chart information and saved credit card data (last 4 digits visible) may have been accessed. The incident was discovered on August 26, 2024. The organization regained access, shut down the breach, and added security measures.

J jump to incidentP pin to compareR raw source

California clockDiscovered Aug 26, 2024 → Notified Sep 11, 202416d ✓ CA 60-day OK16 days discovery → filing

Incident timeline

undetected · 22 days

discovery → filing · 16 days

Aug 4, 2024

Begins

Aug 26, 2024

Discovered

Sep 11, 2024

Filed

vs. sector median

10 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: Hamel Cranial Chiropractic & Wellness INC.
norm: hamel cranial chiropractic wellness

Name: Hamel Cranial Chiropractic & Wellness INC.
norm: hamel cranial chiropractic wellness
Industry: Healthcarellm

Discovered: Aug 26, 2024
Breach occurred: Aug 4, 2024
Undetected for: 22 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 11, 2024
Affected individuals: Not disclosed
Data types: PHIHealth (basic)Financial accountIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Initial access: valid_credentials

During the incident: Got access back to our payment account
Shut down the breech
Added additional security measures to our software and email account
Changes made: Added additional security measures to our software and email account
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 16 days(16 days from discovery to filing)
Compliance flags: CA 60-day OK · 16d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Aug 26, 2024
→ Notified: Sep 11, 2024
16d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Aug 26, 2024 → Notified: Sep 11, 2024	16d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-591536
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 11, 2024
Raw hash: 3cea91746a5be54d91b3cf6987e3824c5616665e025ad68dc942ef6b19d46a20

Reporting entityHamel Cranial Chiropractic & Wellness INC.

Victim entityHamel Cranial Chiropractic & Wellness INC.

Incidentdiscovered Aug 26, 2024

Stated responseGot access back to our payment account

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov