CALIFORNIASocial EngineeringHealthcareHealthcarePhishingStolen CredentialsBusiness Associate (HIPAA)Customer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDHealth (basic)HighResolved

Allcare Medical Management

bd_92f52251c100907e · schema v1 · pii pii-v1

Severity

High

Discovered

—

Filed

Jul 22, 2024

To disclose

—

Affected

16,378

Linked

4 records

Confidence

97%

Full breach record for Allcare Medical Management →

Allcare Medical Management Incorporated, a business associate based in CA, reported to HHS on 2024-07-22 a Hacking/IT Incident (email phishing) affecting 16,378 individuals. An employee was the subject of an email phishing scheme that exposed PHI including names, dates of birth, Social Security numbers, and other demographic information. Breached information located on Email. The BA notified HHS, affected individuals, and media; implemented additional safeguards; and retrained staff on email security. OCR provided technical assistance.

J jump to incidentP pin to compareR raw source

Leak gap clock⏱ Leak >30d

⚠ no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.

⚠ No discovery dateThe OCR public portal omits the discovery date, so the 60-day notification clock cannot be evaluated from this source — only that the filing was submitted.

Incident timeline — partial

? — ?

Breach window unknown

Jul 22, 2024

Filed

No interval is drawn: no breach start or discovery date is on record for this filing.

This filing is one of 4 records about the same incident.View merged incident

A leak claim by lockbit_3 about this victim was first seen 68 days before this filing.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitelockbit_3bd_466f3da75151be6a2024-05-15 · +67dVerified

Regulatory filings (2) · sorted by filing gap

California State AGbd_5e5f21e79920cdaf2024-07-22Candidate
California State AGbd_3a21e436dcdbc8812024-08-02 · +11dVerified

Name: Allcare Medical Management
norm: allcare medical management
Domain: allcare-med.com
Industry: Business Associate

Name: Allcare Medical Management
norm: allcare medical management
Domain: allcare-med.com
Industry: Business Associate
Industry: Healthcaresource default

Discovered: Not extracted — the OCR public portal omits it
Materiality determined: —
Notification sent: —
Affected individuals: 16,378nationwide
Data types: Identity (basic)Government IDHealth (basic)
HHS breach type: Hacking / IT incident
Where the data lived: Email
Covered-entity type: Business associate
Attack vector: Unauthorized Access
MITRE ATT&CK: T1566 PhishingT1078 Valid Accounts
Threat actor: External
Regulator citations: OCR provided technical assistance regarding the HIPAA Rules.
Initial access: phishing_attachment

During the incident: Notified HHS, affected individuals, the media, and posted substitute notice online.
Implemented additional administrative, technical, and security safeguards.
Retrained workforce members on email security precautions.
Changes made: Additional administrative, technical, and security safeguards implemented.
Workforce retraining on email security precautions.
Source: Quoted from the filing itself, not independently verified.

Compliance flags: Leak >30dHHS notified
Discovery-date grounding: no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: not extracted
→ Notified: not extracted
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: not extracted → Notified: not extracted	—	regulatory submission	HHS notified

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings

View merged incident ↗

California State AGJul 22 · first

HHS OCRJul 22 · first · this page

California State AG+11d

Pattern: first filing Jul 22 (CA), last Aug 2 (CA) — a 11-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Jul 22, 2024
Raw hash: 39e64adf634d37ec024be59ff0263c11611d2b8fb18ced2ab04b52f85333380e

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html1.6 KB

Download View at source

Linked disclosures

Ransomware claims (1)

Regulatory filings (2) · sorted by filing gap

Reporting entityAllcare Medical Management

Victim entityAllcare Medical Management

IncidentUnauthorized Access

Stated responseNotified HHS, affected individuals, the media, and posted substitute notice online.

ComplianceLeak >30d

Extraction provenanceno artifact recorded

Source provenanceocrportal.hhs.gov

Source filing