AccidentalHealthcareHealthcareMisconfigurationPublishing ErrorCustomer Data InvolvedDelayed DiscoveryPHIHealth (basic)Identity (basic)LowContained

Castro Valley Health, Inc.

bd_a8cd32e429e8d676 · schema v1 · pii pii-v1

Severity

Low

Discovered

Apr 21, 2020

Filed

Jun 8, 2020

To disclose

7 weeks

Affected

Not disclosed

Confidence

64%

Full breach record for Castro Valley Health, Inc. →

Castro Valley Health, Inc. disclosed that patient information was inadvertently transferred to a third-party website (Docker Hub) during 2016-2017. The organization became aware of the incident on April 21, 2020, and promptly removed the data. Affected data included patient names, dates of birth, medical record numbers, and care start dates, but excluded SSNs, financial data, and clinical notes. The company implemented renewed training, security audits, and policy enhancements.

J jump to incidentP pin to compareR raw source

California clockDiscovered Apr 21, 2020 → Notified May 29, 202038d ✓ CA 60-day OK7 weeks discovery → filing

Incident timeline

undetected · 1572 days

discovery → filing · 7 weeks / 48 days

Jan 1, 2016

Begins

Apr 21, 2020

Discovered

Jun 8, 2020

Filed

vs. sector median

5 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: Castro Valley Health, Inc.
norm: castro valley health

Name: Castro Valley Health, Inc.
norm: castro valley health
Industry: Healthcarellm

Discovered: Apr 21, 2020
Breach occurred: Jan 1, 2016 – Dec 31, 2017
Undetected for: 1,572 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 29, 2020
Affected individuals: Not disclosed
Data types: PHIHealth (basic)Identity (basic)
Attack vector: Misconfiguration

During the incident: Promptly removed the information from the Docker Hub site
Began investigating the incident immediately after learning of it
Changes made: Renewed training and employee orientation
Conducting additional internal security audits and risk assessments
Enhancing our policies and procedures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 weeks(48 days from discovery to filing)
Compliance flags: CA 60-day OK · 38d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Apr 21, 2020
→ Notified: May 29, 2020
38d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Apr 21, 2020 → Notified: May 29, 2020	38d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-190727
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 8, 2020
Raw hash: 7656d58737977885da54568ff31127712ec8995f9a2476cfd17c7ef62aef8b00

Reporting entityCastro Valley Health, Inc.

Victim entityCastro Valley Health, Inc.

Incidentdiscovered Apr 21, 2020

Stated responsePromptly removed the information from the Docker Hub site

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov