Social EngineeringHealthcareHealthcarePhishingStolen CredentialsTargetedCustomer Data InvolvedEmployee Data InvolvedData ExfiltratedPHIIdentity (basic)Government IDHealth (basic)FinancialCredentialsCriticalContained

PIH HEALTH, INC.

bd_a21953b1532e9ead · schema v1 · pii pii-v1

Severity

Critical

Discovered

Jun 18, 2019

Filed

Jan 10, 2020

To disclose

29 weeks

Affected

159,879state residents only

Linked

7 filings

Confidence

66%

Full breach record for PIH HEALTH, INC. →5 incidents on file

PIH Health, a California healthcare provider, experienced a targeted phishing campaign resulting in unauthorized access to employee email accounts between June 11 and June 19, 2019. The incident was discovered on June 18, 2019. Approximately 159,879 California residents were affected, with exposure of names, SSNs, driver's license numbers, medical information, health insurance info, and online credentials. PIH Health engaged cybersecurity experts, reset passwords, implemented additional security measures, and offered credit monitoring.

J jump to incidentP pin to compareR raw source

California clockDiscovered Jun 18, 2019 → Notified Jan 9, 2020205d ✗ CA 60-day late29 weeks discovery → filing

Incident timeline

undetected · 7 days

discovery → filing · 29 weeks / 206 days

Jun 11, 2019

Begins

Jun 18, 2019

Discovered

Jan 10, 2020

Filed

vs. sector median

+17 wks slower

This filing is one of 7 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

Massachusetts State AGbd_27d7777e802fa91b2020-01-10Verified
HHS OCRbd_4a28b4853227a5ed2020-01-10Verified
New Hampshire State AGbd_8571a8c5bf1cf1e82020-01-10Verified
Indiana State AGbd_affe7d5b7013704d2020-01-10Verified

Show 2 more filings ↓up to 1930d gap

Illinois State AGbd_a91cc01f9afd40902020-01-01 · +9dCandidate
HHS OCR enforcementbd_86698e91d73c9fe22025-04-23 · +1930dVerified by operator

Name: PIH Health
norm: pih health

Name: PIH HEALTH, INC.
norm: pih health
Industry: Healthcarellm

Discovered: Jun 18, 2019
Breach occurred: Jun 11, 2019 – Jun 19, 2019
Undetected for: 7 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 9, 2020
Affected individuals: 159,879state-resident count only
Data types: PHIIdentity (basic)Government IDHealth (basic)FinancialCredentials
Data elements: Social Security numberMedical information
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: External
Regulator citations: Notified California Attorney GeneralNotification pursuant to HIPAA and Cal. Civ. Code § 1798.82
Initial access: phishing_link

During the incident: Reset the passwords required to access the employee email accounts
Implemented additional email and network security measures
Engaged leading, independent cybersecurity experts to determine what happened
Enabled new email security appliances
Immediately changing passwords for affected individuals and high risk accounts
Promptly notifying staff of the incident to guard against reoccurrence
Offered 12 months of single bureau credit monitoring services through Kroll
Changes made: Reinforcing two-factor authentication where available
Implementing additional training to guard against phishing attacks
Revising PIH’s policies and procedures
Deploying an incident response team and protocol based upon the NIST framework
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 29 weeks(206 days from discovery to filing)
Compliance flags: CA 60-day late · 205d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Jun 18, 2019
→ Notified: Jan 9, 2020
205d 60 days (analyst band, pre-2026 discoveries) CA 60-day late

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Jun 18, 2019 → Notified: Jan 9, 2020	205d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 5 states

View merged incident ↗

Illinois State AGJan 1 · first

Massachusetts State AG+9d

HHS OCR+9d

New Hampshire State AG+9d

Indiana State AG+9d

California State AG+9d · this page

HHS OCR enforcement+1939d

Pattern: first filing Jan 1 (IL), last Apr 23 — a 1939-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-185839
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 10, 2020
Raw hash: 53f8d653e57ee6bebe31b81ad0dc243eced744f12c7494378331ef12bd4d0b5e

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityPIH Health

Victim entityPIH HEALTH, INC.

Incidentdiscovered Jun 18, 2019

Stated responseReset the passwords required to access the employee email accounts

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov