HackingHealthcareHealthcareCustomer Data InvolvedData ExfiltratedPIIPHIIdentity (basic)LowContained

Cooper Aerobics Enterprises, Inc

bd_aa0d549017fb36cc · schema v1 · pii pii-v1

Severity

Low

Discovered

Feb 3, 2023

Filed

Jan 5, 2024

To disclose

48 weeks

Affected

Not disclosed

Linked

4 filings

Confidence

64%

Full breach record for Cooper Aerobics Enterprises, Inc →

Cooper Aerobics Enterprises, Inc. notified the California AG of a cybersecurity incident where unauthorized access occurred on February 3, 2023. The company became aware of the incident on the same date. Forensic investigation confirmed potential access or removal of sensitive data, including personal and medical information. The threat was contained by disabling unauthorized access. The company engaged external cybersecurity professionals and conducted a manual review of impacted servers. Affected individuals are offered credit monitoring and identity theft protection services.

J jump to incidentP pin to compareR raw source

California clockDiscovered Feb 3, 2023 → Notified Jan 5, 2024336d ✗ CA 60-day late48 weeks discovery → filing

Incident timeline

discovery → filing · 48 weeks / 336 days

Feb 3, 2023

Begins

Feb 3, 2023

Discovered

Jan 5, 2024

Filed

vs. sector median

+35 wks slower

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Montana State AGbd_90b909fc2a821feb2024-01-05Candidate
Illinois State AGbd_33d184c08834a4882024-01-01 · +4dVerified
New Hampshire State AGbd_2c6b9a5de73115982024-01-17 · +12dVerified

Name: Cooper Aerobics Enterprises, Inc
norm: cooper aerobics
Domain: cooperaerobics.com

Name: Cooper Aerobics Enterprises, Inc
norm: cooper aerobics
Domain: cooperaerobics.com
Industry: Healthcarellm

Discovered: Feb 3, 2023
Breach occurred: Feb 3, 2023
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 5, 2024
Affected individuals: Not disclosed
Data types: PIIPHIIdentity (basic)
Attack vector: Unknown
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External

During the incident: Contained the threat by disabling all unauthorized access to our network
Commenced a prompt and thorough investigation
Working very closely with external cybersecurity professionals experienced in handling these types of incidents
Conducted a thorough and detailed manual review of all the data contained on the impacted servers
Changes made: Providing complimentary identity theft protection services
Providing access to Single Bureau Credit Monitoring/Single Bureau Credit Report/Single Bureau Credit Score services at no charge
Providing proactive fraud assistance through Cyberscout through Identity Force
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 48 weeks(336 days from discovery to filing)
Compliance flags: CA 60-day late · 336d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Feb 3, 2023
→ Notified: Jan 5, 2024
336d 60 days (analyst band, pre-2026 discoveries) CA 60-day late

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Feb 3, 2023 → Notified: Jan 5, 2024	336d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Illinois State AGJan 1 · first

Montana State AG+4d

California State AG+4d · this page

New Hampshire State AG+16d

Pattern: first filing Jan 1 (IL), last Jan 17 (NH) — a 16-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-578895
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 5, 2024
Raw hash: fe29448f52f88310a81a60dde7ea81c6dbf911743eb437861f13695625089a51

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityCooper Aerobics Enterprises, Inc

Victim entityCooper Aerobics Enterprises, Inc

Incidentdiscovered Feb 3, 2023

Stated responseContained the threat by disabling all unauthorized access to our network

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov