PhysicalHealthcareHealthcareTheftCustomer Data InvolvedDelayed DiscoveryPHIHealth (basic)Government IDIdentity (basic)Financial accountHighContained

Gordon Schanzlin New Vision Institute

bd_999e20a3b5b995a6 · schema v1 · pii pii-v1

Severity

High

Discovered

Jun 15, 2018

Filed

Aug 16, 2018

To disclose

9 weeks

Affected

9,351state residents only

Linked

3 filings

Confidence

65%

Full breach record for Gordon Schanzlin New Vision Institute →

Gordon Schanzlin New Vision Institute notified California residents that medical records, including PHI and SSNs, were potentially compromised after a box of records was recovered from a house during a USPS raid. The incident is linked to an unauthorized entry into a storage unit in October 2017. 9,351 California residents were affected. The organization offered one year of credit monitoring via Experian and implemented additional physical security measures.

J jump to incidentP pin to compareR raw source

California clockDiscovered Jun 15, 2018 → Notified Aug 14, 201860d ✓ CA 60-day OK9 weeks discovery → filing

Incident timeline

undetected · 257 days

discovery → filing · 9 weeks / 62 days

Oct 1, 2017

Begins

Jun 15, 2018

Discovered

Aug 16, 2018

Filed

vs. sector median

on median

This filing is one of 3 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_b6d0ad8cf89f2b6a2018-08-16Verified
HHS OCRbd_31bbdb93ebd4f0cd2018-08-10 · +6dVerified by operator

Name: Gordon Schanzlin New Vision Institute
norm: gordon schanzlin new vision institute

Name: Gordon Schanzlin New Vision Institute
norm: gordon schanzlin new vision institute
Industry: Healthcarellm

Discovered: Jun 15, 2018
Breach occurred: Oct 1, 2017 – Oct 31, 2017
Undetected for: 257 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 14, 2018
Affected individuals: 9,351state-resident count only
Data types: PHIHealth (basic)Government IDIdentity (basic)Financial account
Data elements: Social Security numberMedical information
Attack vector: Unknown
MITRE ATT&CK: T1052 Exfiltration Over Physical Medium
Threat actor: External
Regulator citations: Cooperating with U.S. Postal Inspection Service

During the incident: Launched an internal investigation to determine the nature and scope of this event
Cooperating with law enforcement as their investigation continues
Provided written notice of this incident to all affected individuals
Providing access to credit monitoring services for one (1) year, through Experian
Providing impacted individuals with guidance on how to better protect against identity theft and fraud
Changes made: All information has been removed from the storage unit in question
Information is now stored with additional physical security measures
Working to implement additional safeguards and training to its employees
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(62 days from discovery to filing)
Compliance flags: CA 60-day OK · 60d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Jun 15, 2018
→ Notified: Aug 14, 2018
60d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Jun 15, 2018 → Notified: Aug 14, 2018	60d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 2 states

View merged incident ↗

HHS OCRAug 10 · first

Massachusetts State AG+6d

California State AG+6d · this page

Pattern: first filing Aug 10 (CA), last Aug 16 (CA) — a 6-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-138923
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 16, 2018
Raw hash: aaa77e556f1645cb5a11492f40bd5a1641669c76618e2a93ecd77943572b47d5

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityGordon Schanzlin New Vision Institute

Victim entityGordon Schanzlin New Vision Institute

Incidentdiscovered Jun 15, 2018

Stated responseLaunched an internal investigation to determine the nature and scope of this event

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov