PhysicalTheftSupply Chain (3P Vendor)Customer Data InvolvedPHIHEALTH_BASICIDENTITY_BASICLowContained
Anthem Inc.
bd_9b9bf2a33a0aa022 · schema v1 · pii pii-v1
Full breach record for Anthem Inc. →Anthem, Inc. reported a physical break-in at a third-party vendor's office on August 3, 2021. The vendor, The Foundation for Medical Care of Tulare & Kings Counties, Inc., had an external backup drive stolen containing scanned paper claims. The breach exposed PHI including names, addresses, dates of birth, and healthcare IDs. Anthem notified affected individuals on October 29, 2021, offering one year of credit monitoring.
California clockDiscovered Aug 16, 2021 → Notified Oct 29, 202174d ✗ CA 60-day late10 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
This filing is one of 2 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (1) · sorted by filing gap
- bd_a56022fe9b9d5b17HHS OCRfiled 2021-10-27(1d gap)Verified
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-546965
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Oct 28, 2021
- Raw hash
- 52524877a4d54b83d8db2da08d40ecf53e5e9d9326e52d8e4ae5b2b77e439f39
Reporting entity
- Name
- Flag & Anthemnorm: flag anthem
- Domain
- flagandanthem.com
Victim entity
- Name
- Anthem Inc.norm: anthem
- Domain
- anthem.com
Incident
- Discovered
- Aug 16, 2021
- Materiality determined
- —
- Notification sent
- Oct 29, 2021
- Affected individuals
- Not disclosed
- Data types
- PHIHEALTH_BASICIDENTITY_BASIC
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1052 Exfiltration Over Physical Medium
- Threat actor
- ExternalFinancial
- Regulator citations
- Foundation reported this incident to the City of Merced Police Department immediately
- Third party
- via The Foundation for Medical Care of Tulare & Kings Counties, Inc.
Compliance
- Time to disclose
- 10 weeks(73 days from discovery to filing)
- Compliance flags
- CA 60-day late · 74d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Aug 16, 2021→ Notified: Oct 29, 202174d 60 days (analyst band, pre-2026 discoveries) CA 60-day late
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.