HackingStolen CredentialsSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedPHIIDENTITY_BASICHEALTH_BASICLowContained
Insulet Corporation
bd_a9a5e74719a5088f · schema v1 · pii pii-v1
Full breach record for Insulet Corporation →Insulet Corporation notified customers of a data security incident involving its vendor, Cornerstone On-Demand. An unauthorized third party gained access to Cornerstone's systems on January 13, 2021, potentially accessing and downloading customer names, email addresses, and training records. Insulet discovered the incident on January 19, 2021, when notified by the vendor. Cornerstone blocked access and implemented security measures. Insulet is transitioning to a new vendor and will require deletion of data.
California clockDiscovered Jan 19, 2021 → Notified Mar 18, 202158d ✓ CA 60-day OK8 weeks discovery → filing
This filing is one of 3 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (2) · sorted by filing gap
- bd_ec64490fbdd5840bHHS OCRfiled 2021-03-19Verified
- bd_dc53fa22a54060f9Montana State AGfiled 2021-03-18(1d gap)Verified
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-539286
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Mar 19, 2021
- Raw hash
- e04ba2fef27925282e9add4086fe06e6a552d8323f4f0bc2c246354b6f31cf61
Reporting entity
- Name
- Insulet Corporationnorm: insulet
- Domain
- insulet.com
Victim entity
- Name
- Insulet Corporationnorm: insulet
- Domain
- insulet.com
Incident
- Discovered
- Jan 19, 2021
- Materiality determined
- —
- Notification sent
- Mar 18, 2021
- Affected individuals
- Not disclosed
- Data types
- PHIIDENTITY_BASICHEALTH_BASIC
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
- Threat actor
- External
- Third party
- via Cornerstone On-Demand
- Initial access
- trusted_relationship
Compliance
- Time to disclose
- 8 weeks(59 days from discovery to filing)
- Compliance flags
- CA 60-day OK · 58d
- Discovery-date grounding
- letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Jan 19, 2021→ Notified: Mar 18, 202158d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.