HackingGovernmentGovernmentCustomer Data InvolvedPHIHealth (basic)Identity (basic)LowContained

Mono County

bd_abaff2ae87653c44 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jul 28, 2020

Filed

Sep 25, 2020

To disclose

8 weeks

Affected

Not disclosed

Linked

2 filings

Confidence

66%

Full breach record for Mono County →

Mono County reported unauthorized access to its online COVID-19 statistics database between April 9, 2020, and July 14, 2020. The breach, discovered on July 28, 2020, potentially exposed Protected Health Information (PHI) including names, dates of birth, gender, race, region, test results, and clinical notes. No Social Security numbers or financial data were involved. The County secured the database to prevent further external access.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 110 days

discovery → filing · 8 weeks / 59 days

Apr 9, 2020

Begins

Jul 28, 2020

Discovered

Sep 25, 2020

Filed

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

HHS OCRbd_54b76d688e3cec042020-09-25Verified

Name: Mono County
norm: mono county

Name: Mono County
norm: mono county
Industry: Governmentllm

Discovered: Jul 28, 2020
Breach occurred: Apr 9, 2020 – Jul 14, 2020
Undetected for: 110 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: PHIHealth (basic)Identity (basic)
Attack vector: Unauthorized Access
Threat actor: External

During the incident: Took immediate steps to secure the information it stores in its online database such that access from the outside has been successfully and completely prevented going forward
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(59 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings

View merged incident ↗

HHS OCRSep 25 · first

California State AGSep 25 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-194510
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 25, 2020
Raw hash: 0dd4acab9b27050dc4503efb0a33144562495bb4d0264997b275c7ecd3c29da8

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityMono County

Victim entityMono County

Incidentdiscovered Jul 28, 2020

Stated responseTook immediate steps to secure the information it stores in its online database such that access from the outside has been successfully and completely prevented going forward

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov