AccidentalHealthcareTechnologyHealthcareMisconfigurationPublishing ErrorCustomer Data InvolvedEmployee Data InvolvedPIIIdentity (basic)CredentialsLocationBehaviorMetadataPHIHealth (basic)MinorMediumResolved

Minimed Distribution Corp

bd_8ed689cca36706d2 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 13, 2023

Filed

Apr 14, 2023

To disclose

9 weeks

Affected

Not disclosed

Linked

5 filings

Confidence

66%

Full breach record for Minimed Distribution Corp →3 incidents on file

Medtronic MiniMed and MiniMed Distribution Corp disclosed that tracking technologies (Google Analytics, Crashlytics, Firebase Authentication) in the InPen App inadvertently transmitted user data to Google. The incident affected users since September 2020. Data exposed included email, IP address, phone number, usernames, passwords, and device identifiers. No SSN or financial data was involved. The company removed Google Analytics and is transitioning to new platforms.

J jump to incidentP pin to compareR raw source

California clockDiscovered Feb 13, 2023 → Notified Apr 14, 202360d ✓ CA 60-day OK9 weeks discovery → filing

Incident timeline

undetected · 895 days

discovery → filing · 9 weeks / 60 days

Sep 1, 2020

Begins

Feb 13, 2023

Discovered

Apr 14, 2023

Filed

vs. sector median

4 wks faster

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Washington State AGbd_03be0669e0a17edb2023-04-14Verified
Oregon State AGbd_1625edd17f6757c42023-04-14Verified
HHS OCRbd_92fc04ad3510e5402023-04-14Verified
Illinois State AGbd_8dd20bfa7f1c77ea2023-01-01 · +103dCandidate

Name: Minimed Distribution Corp
norm: minimed distribution

Name: Minimed Distribution Corp
norm: minimed distribution
Industry: HealthcarellmTechnologyllm

Discovered: Feb 13, 2023
Breach occurred: Sep 1, 2020
Undetected for: 895 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 14, 2023
Affected individuals: Not disclosed
Data types: PIIIdentity (basic)CredentialsLocationBehaviorMetadataPHIHealth (basic)Minor
Attack vector: Misconfiguration
Regulator citations: Filed breach notification with California Attorney General
Third party: via Google

During the incident: Launched an internal investigation to better understand what user information had been shared with Google
Removed Google Analytics from the latest version of the InPen App
Implementing a plan to transition from Crashlytics and Firebase Authentication to new crash reporting and authentication platforms
Proactively assessing how to further mitigate the risk of unauthorized disclosures of user protected health information
Continuing to monitor information security and technology solutions
Changes made: Removed Google Analytics from the latest version of the InPen App
Implementing a plan to transition from Crashlytics and Firebase Authentication to new crash reporting and authentication platforms
Making improvements and enhancements to information security and technology solutions where appropriate
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(60 days from discovery to filing)
Compliance flags: CA 60-day OK · 60d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Feb 13, 2023
→ Notified: Apr 14, 2023
60d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Feb 13, 2023 → Notified: Apr 14, 2023	60d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 4 states

View merged incident ↗

Illinois State AGJan 1 · first

Washington State AG+103d

Oregon State AG+103d

HHS OCR+103d

California State AG+103d · this page

Pattern: first filing Jan 1 (IL), last Apr 14 (CA) — a 103-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-565575
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 14, 2023
Raw hash: c89be5a9fca3c614ec4e48a7cea96d0f1a7da741373a7a9d178c577dd28c0fbe

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityMinimed Distribution Corp

Victim entityMinimed Distribution Corp

Incidentdiscovered Feb 13, 2023

Stated responseLaunched an internal investigation to better understand what user information had been shared with Google

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov