MisuseHealthcareRetail & ConsumerHealthcareData MishandlingCustomer Data InvolvedDelayed DiscoveryPHIGovernment IDIdentity (basic)Health (basic)MediumResolved

San Jose Medical Supply Co., Inc.

bd_ada46b326a0e68b9 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 1, 2013

Filed

Jul 18, 2013

To disclose

7 weeks

Affected

Not disclosed

Confidence

65%

Full breach record for San Jose Medical Supply Co., Inc. →

San Jose Medical Supply Co., Inc. disclosed an insider breach where former employees, officers, and/or agents unauthorizedly disclosed protected health information (PHI) and personally identifiable information (PII) of customers to competing entities (Front Medical Supplies, Inc. and Living Medical Equipment, Inc.) between August 2011 and December 2011. The breach was discovered in June 2013 by new management. Affected data included names, SSNs, Medi-Cal IDs, diagnoses, and prescriptions. The company terminated responsible employees, engaged forensic investigators, notified regulators (CA AG, HHS), and implemented enhanced security protocols.

J jump to incidentP pin to compareR raw source

California clockDiscovered Jun 1, 2013 → Notified Jul 17, 201346d ✓ CA 60-day OK7 weeks discovery → filing

Incident timeline

undetected · 670 days

discovery → filing · 7 weeks / 47 days

Aug 1, 2011

Begins

Jun 1, 2013

Discovered

Jul 18, 2013

Filed

vs. sector median

4 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: San Jose Medical Supply Co., Inc.
norm: san jose medical supply
Domain: sjmedsupply.com

Name: San Jose Medical Supply Co., Inc.
norm: san jose medical supply
Domain: sjmedsupply.com
Industry: HealthcarellmRetail & Consumerllm

Discovered: Jun 1, 2013
Breach occurred: Aug 1, 2011 – Dec 31, 2011
Undetected for: 670 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 17, 2013
Affected individuals: Not disclosed
Data types: PHIGovernment IDIdentity (basic)Health (basic)
Data elements: Social Security numberDate of birthMedical information
Attack vector: Insider
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: Internal
Regulator citations: Notified the California Attorney General’s office of this incidentNotified the US Department of Health and Human Services of this incident
Initial access: insider_action

During the incident: Initiated a forensics security investigation
Terminated responsible employees
Notified the California Attorney General’s office of this incident
Notified the US Department of Health and Human Services of this incident
Notified the local media to ensure that all of our customers are aware of the breach
Brought a civil action against former employees, officers and/or agents in Santa Clara Superior Court
Changes made: Added additional computer security protections and protocols to ensure that your personal information is protected from unauthorized access
Updated our policies and procedures to highlight the importance of maintaining health privacy
Educated our workforce about the importance of maintaining health privacy
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 weeks(47 days from discovery to filing)
Compliance flags: CA 60-day OK · 46d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Jun 1, 2013
→ Notified: Jul 17, 2013
46d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Jun 1, 2013 → Notified: Jul 17, 2013	46d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-42264
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 18, 2013
Raw hash: 81d2ecef4de50ed7fe290140473f959c828c8771debd9d6f767b60cdcca83b19

Reporting entitySan Jose Medical Supply Co., Inc.

Victim entitySan Jose Medical Supply Co., Inc.

Incidentdiscovered Jun 1, 2013

Stated responseInitiated a forensics security investigation

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov