HackingStolen CredentialsSupply Chain (3P Vendor)Customer Data InvolvedEmployee Data InvolvedPHIIDENTITY_BASICIDENTITY_GOVERNMENTHEALTH_BASICMediumContained
Palomar Health
bd_8c64d267d7bf4a75 · schema v1 · pii pii-v1
Full breach record for Palomar Health →Palomar Health notified patients of a data breach involving its vendor, PharMerica. An unknown third party accessed PharMerica's systems on March 12-13, 2023. Affected data included names, addresses, dates of birth, Social Security numbers, medications, and health insurance information for patients who received services at Palomar Continuing Care Center or The Villas at Poway between 2001 and 2020. Palomar Health learned of the incident on May 31, 2023, and conducted its own investigation. PharMerica is offering one year of credit and identity theft monitoring.
California clockDiscovered Mar 13, 2023 → Notified Jun 21, 2023100d ✗ CA 60-day late14 weeks discovery → filing
Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-568299
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jun 21, 2023
- Raw hash
- 9c1d13f3ddf92c21afedc991a276102f135affbf648eada8230f446abf194aa9
Reporting entity
- Name
- Palomar Healthnorm: palomar health
- Domain
- palomarhealth.org
Victim entity
- Name
- Palomar Healthnorm: palomar health
- Domain
- palomarhealth.org
Incident
- Discovered
- Mar 13, 2023
- Materiality determined
- —
- Notification sent
- Jun 21, 2023
- Affected individuals
- Not disclosed
- Data types
- PHIIDENTITY_BASICIDENTITY_GOVERNMENTHEALTH_BASIC
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1078 Valid Accounts
- Threat actor
- External
- Regulator citations
- Notified the California Department of Public Health
- Third party
- via PharMerica
Compliance
- Time to disclose
- 14 weeks(100 days from discovery to filing)
- Compliance flags
- CA 60-day late · 100d
- Discovery-date grounding
- letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Mar 13, 2023→ Notified: Jun 21, 2023100d 60 days (analyst band, pre-2026 discoveries) CA 60-day late
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.