HackingHealthcareHealthcareSupply Chain (3P Vendor)Business Associate (HIPAA)Customer Data InvolvedDelayed DiscoveryPHIHealth (basic)Identity (basic)Government IDHighContained

AltaMed Health Services Corporation

bd_9a11e96fb50bd9bf · schema v1 · pii pii-v1

Severity

High

Discovered

Jun 22, 2018

Filed

Feb 15, 2019

To disclose

34 weeks

Affected

5,767state residents only

Linked

3 filings

Confidence

66%

Full breach record for AltaMed Health Services Corporation →9 incidents on file

AltaMed Health Services Corporation notified the California Attorney General of a data breach affecting 5,767 California residents. The incident occurred at Sharecare Health Data Services (SHDS), an AltaMed business associate. An unauthorized third party gained access to the SHDS network as early as May 21, 2018, with abnormal activity detected on June 22, 2018. Affected data included patient names, addresses, dates of birth, unique identification numbers, medical record numbers, and facility information. Notification letters were mailed on February 15, 2019.

J jump to incidentP pin to compareR raw source

California clockDiscovered Jun 22, 2018 → Notified Feb 15, 2019238d ✗ CA 60-day late34 weeks discovery → filing

Incident timeline

undetected · 32 days

discovery → filing · 34 weeks / 238 days

May 21, 2018

Begins

Jun 22, 2018

Discovered

Feb 15, 2019

Filed

vs. sector median

+24 wks slower

This filing is one of 3 filings about the same incident.View merged incident

Part of Sharecare Health Data Services, LLC supply-chain incident (2019) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

HHS OCRbd_167b95d06427d66d2019-02-15Candidate
Illinois State AGbd_dfd1d3e1f5225db62019-01-01 · +45dVerified

Name: AltaMed Health Services Corporation
norm: altamed health

Name: AltaMed Health Services Corporation
norm: altamed health
Industry: Healthcarellm

Discovered: Jun 22, 2018
Breach occurred: May 21, 2018
Undetected for: 32 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 15, 2019
Affected individuals: 5,767state-resident count only
Data types: PHIHealth (basic)Identity (basic)Government ID
Data elements: Date of birthMedical information
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified California Attorney General
Third party: via Sharecare Health Data Services
Initial access: supply_chain

During the incident: Worked diligently to learn as much as possible about the incident
Identified those AltaMed patients whose information may have been affected for purposes of notification
Notified 5,767 California residents regarding this data security incident
Mailed notification letters via first class U.S. mail
Changes made: SHDS has taken affirmative steps to respond to this incident and to help prevent similar incidents from occurring in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 34 weeks(238 days from discovery to filing)
Compliance flags: CA 60-day late · 238d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Jun 22, 2018
→ Notified: Feb 15, 2019
238d 60 days (analyst band, pre-2026 discoveries) CA 60-day late

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Jun 22, 2018 → Notified: Feb 15, 2019	238d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 2 states

View merged incident ↗

Illinois State AGJan 1 · first

HHS OCR+45d

California State AG+45d · this page

Pattern: first filing Jan 1 (IL), last Feb 15 (CA) — a 45-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-144769
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 15, 2019
Raw hash: 22262178bd8f9bb2118c33d991500e6d7176f99031cc188dc30a4ad16830689f

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityAltaMed Health Services Corporation

Victim entityAltaMed Health Services Corporation

Incidentdiscovered Jun 22, 2018

Stated responseWorked diligently to learn as much as possible about the incident

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov