PhysicalHealthcareHealthcareTheftCustomer Data InvolvedPHIIdentity (basic)Financial accountFinancial credentialsLowResolved

Sierra Nevada Primary Care Physicians

bd_a4c7d003c1dbf6ce · schema v1 · pii pii-v1

Severity

Low

Discovered

May 20, 2021

Filed

Jul 16, 2021

To disclose

8 weeks

Affected

Not disclosed

Linked

5 filings

Confidence

65%

Full breach record for Sierra Nevada Primary Care Physicians →

Sierra Nevada Primary Care Physicians notified patients that receipts containing PHI and financial data were stolen from a suspect's vehicle. The incident involved receipts from Jan-Mar 2019. The organization discovered the breach on May 20, 2021, after being contacted by the District Attorney. Affected data included names, partial or full credit card numbers, and CVVs. The organization offered identity protection services.

J jump to incidentP pin to compareR raw source

California clockDiscovered May 20, 2021 → Notified Jul 16, 202157d ✓ CA 60-day OK8 weeks discovery → filing

Incident timeline

undetected · 870 days

discovery → filing · 8 weeks / 57 days

Jan 1, 2019

Begins

May 20, 2021

Discovered

Jul 16, 2021

Filed

vs. sector median

3 wks faster

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Maine State AGbd_7c18aa2787bbc1f42021-07-16Verified
Montana State AGbd_f0ff997dab9598432021-07-16Verified
HHS OCRbd_f81da92a987436522021-07-16Verified
Illinois State AGbd_4239a30ece11c39e2021-01-01 · +196dCandidate

Name: Sierra Nevada Primary Care Physicians
norm: sierra nevada primary care physicians

Name: Sierra Nevada Primary Care Physicians
norm: sierra nevada primary care physicians
Industry: Healthcarellm

Discovered: May 20, 2021
Breach occurred: Jan 1, 2019 – Mar 20, 2019
Undetected for: 870 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 16, 2021
Affected individuals: Not disclosed
Data types: PHIIdentity (basic)Financial accountFinancial credentials
Attack vector: Unknown
MITRE ATT&CK: T1052 Exfiltration Over Physical Medium
Threat actor: External
Regulator citations: Received notification from District Attorney's office

During the incident: Reviewed payment records to identify affected individuals
Stored receipts in a locked room with limited access
Blacked out credit or debit card numbers on receipts
Offered identity theft protection services through IDX
Changes made: Enhanced security of receipt storage
Implemented blacking out of card numbers on receipts
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(57 days from discovery to filing)
Compliance flags: CA 60-day OK · 57d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: May 20, 2021
→ Notified: Jul 16, 2021
57d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: May 20, 2021 → Notified: Jul 16, 2021	57d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 4 states

View merged incident ↗

Illinois State AGJan 1 · first

Maine State AG+196d

Montana State AG+196d

HHS OCR+196d

California State AG+196d · this page

Pattern: first filing Jan 1 (IL), last Jul 16 (CA) — a 196-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-542979
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 16, 2021
Raw hash: bafe4bb8c46b5d5e9f9eaf0c3dd5c3bba989a595e36f6d25fa5d59be2a0a6707

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entitySierra Nevada Primary Care Physicians

Victim entitySierra Nevada Primary Care Physicians

Incidentdiscovered May 20, 2021

Stated responseReviewed payment records to identify affected individuals

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov