HackingStolen CredentialsSupply Chain (3P Vendor)Data ExfiltratedIDENTITY_BASICIDENTITY_GOVERNMENTHEALTH_BASICPHIMediumContained
Silver Creek Fitness & Physical Therapy
bd_9d64cee62dcdf72b · schema v1 · pii pii-v1
Full breach record for Silver Creek Fitness & Physical Therapy →Silver Creek Fitness & Physical Therapy reported a data breach involving a third-party billing and software provider's Amazon S3 storage account. The account was accessible to an external security researcher from May 1, 2016, to September 11, 2016. Affected data included names, SSNs, driver's license numbers, Medicare numbers, and PHI. The researcher downloaded the data but deleted it. The company provided credit monitoring via Equifax and notified regulators and HHS.
California clockDiscovered Sep 11, 2016 → Notified Oct 19, 201638d ✓ CA 60-day OK6 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-64521
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Oct 24, 2016
- Raw hash
- 2357b86ce1e9a4786cf6c79b0cf32af127511257079a560612017259fff8286a
Reporting entity
- Name
- Silver Creek Fitness & Physical Therapynorm: silver creek fitness physical therapy
Victim entity
- Name
- Silver Creek Fitness & Physical Therapynorm: silver creek fitness physical therapy
Incident
- Discovered
- Sep 11, 2016
- Materiality determined
- —
- Notification sent
- Oct 19, 2016
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENTHEALTH_BASICPHI
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1195 Supply Chain CompromiseT1041 Exfiltration Over C2 Channel
- Threat actor
- External
- Regulator citations
- Providing notice to state regulatorsProviding notice to the Department of Health and Human Services
- Initial access
- trusted_relationship
Compliance
- Time to disclose
- 6 weeks(43 days from discovery to filing)
- Compliance flags
- CA 60-day OK · 38d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Sep 11, 2016→ Notified: Oct 19, 201638d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.