HackingHealthcareHealthcareStolen CredentialsSupply Chain (3P Vendor)Customer Data InvolvedEmployee Data InvolvedPHIIdentity (basic)Government IDHealth (basic)MediumContained

Palomar Health

bd_8c64d267d7bf4a75 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 13, 2023

Filed

Jun 21, 2023

To disclose

14 weeks

Affected

Not disclosed

Confidence

65%

Full breach record for Palomar Health →4 incidents on file

Palomar Health notified patients of a data breach involving its vendor, PharMerica. An unknown third party accessed PharMerica's systems on March 12-13, 2023. Affected data included names, addresses, dates of birth, Social Security numbers, medications, and health insurance information for patients who received services at Palomar Continuing Care Center or The Villas at Poway between 2001 and 2020. Palomar Health learned of the incident on May 31, 2023, and conducted its own investigation. PharMerica is offering one year of credit and identity theft monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 1 days

discovery → filing · 14 weeks / 100 days

Mar 12, 2023

Begins

Mar 13, 2023

Discovered

Jun 21, 2023

Filed

vs. sector median

+2 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: Palomar Health
norm: palomar health
Domain: palomarhealth.org

Name: Palomar Health
norm: palomar health
Domain: palomarhealth.org
Industry: Healthcarellm

Discovered: Mar 13, 2023
Breach occurred: Mar 12, 2023 – Mar 13, 2023
Undetected for: 1 dayoccurrence → discovery
Materiality determined: —
Notification sent: Jun 21, 2023
Affected individuals: Not disclosed
Data types: PHIIdentity (basic)Government IDHealth (basic)
Data elements: Social Security numberDate of birth
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified the California Department of Public Health
Third party: via PharMerica

During the incident: Performed its own investigation based on the information received from PharMerica
Notified the California Department of Public Health of this incident
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 14 weeks(100 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-568299
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 21, 2023
Raw hash: 9c1d13f3ddf92c21afedc991a276102f135affbf648eada8230f446abf194aa9

Reporting entityPalomar Health

Victim entityPalomar Health

Incidentdiscovered Mar 13, 2023

Stated responsePerformed its own investigation based on the information received from PharMerica

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov