HackingHealthcareHealthcareCustomer Data InvolvedEmployee Data InvolvedPHIHealth (basic)Government IDIdentity (basic)MediumContained

Wilmington Community Clinic

bd_8a2ca3725d4dd936 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 13, 2024

Filed

Dec 11, 2025

To disclose

16 months

Affected

Not disclosed

Linked

2 filings

Confidence

65%

Full breach record for Wilmington Community Clinic →2 incidents on file

Wilmington Community Clinic discovered on August 13, 2024, that its systems were potentially compromised by an unauthorized actor. The clinic immediately disconnected network access and engaged third-party cybersecurity firms for forensic investigation. The incident may have exposed personal information including health insurance identification numbers, medical information, dates of birth, driver's license or state ID numbers, and names. The clinic is providing 12 months of complimentary credit monitoring and identity theft restoration services to affected individuals.

J jump to incidentP pin to compareR raw source

California clockDiscovered Aug 13, 2024 → Notified Dec 10, 2025484d ✗ CA 60-day late16 months discovery → filing

Incident timeline

discovery → filing · 16 months / 485 days

Aug 13, 2024

Begins

Aug 13, 2024

Discovered

Dec 11, 2025

Filed

vs. sector median

+60 wks slower

This filing is one of 2 filings about the same incident.View merged incident

A leak claim by ransomhub about this victim was first seen 464 days before this filing.View originating leak claim

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_7fc38def6aec3ba12025-12-12 · +1dVerified

Name: Wilmington Community Clinic
norm: wilmington community clinic
Domain: wilmingtoncc.org

Name: Wilmington Community Clinic
norm: wilmington community clinic
Domain: wilmingtoncc.org
Industry: Healthcarellm

Discovered: Aug 13, 2024
Breach occurred: Aug 13, 2024
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 10, 2025
Affected individuals: Not disclosed
Data types: PHIHealth (basic)Government IDIdentity (basic)
Data elements: Date of birthMedical information
Attack vector: Unknown
Threat actor: External

During the incident: Disconnected all access to the network
Engaged a specialized third-party cybersecurity firm and IT personnel to assist with securing the environment
Conducted a comprehensive forensic investigation to determine the nature and scope of the incident
Engaged a third-party vendor to review the data that was compromised
Engaged a third-party notice vendor to assist with the mailings, call center, and provide identity theft protection services
Restored operations in a safe and secure manner
Enhanced our security measures
Changes made: Enhanced our security measures
Providing 12 months of complimentary credit monitoring and identity theft restoration services through HaystackID
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 16 months(485 days from discovery to filing)
Compliance flags: CA 60-day late · 484dLeak >180d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Aug 13, 2024
→ Notified: Dec 10, 2025
484d 60 days (analyst band, pre-2026 discoveries) CA 60-day late

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Aug 13, 2024 → Notified: Dec 10, 2025	484d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

California State AGDec 11 · first · this page

Massachusetts State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-615600
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 11, 2025
Raw hash: 7bebbc77c3b83dbcc8058d41d5b8ce635652b1626f5d8e487a4a1f567b1f5c2b

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityWilmington Community Clinic

Victim entityWilmington Community Clinic

Incidentdiscovered Aug 13, 2024

Stated responseDisconnected all access to the network

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov