DisclosureLens
PhysicalHealthcareProfessional ServicesHealthcareTheftCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDHealth (basic)EmploymentMediumContained

OneDigital Health and Benefits

bd_b844a9cfd0c017cc · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 9, 2020

Filed

Apr 7, 2020

To disclose

13 weeks

Affected

2state residents only

Confidence

66%

OneDigital Health and Benefits reported the theft of an employee's unencrypted, password-protected electronic device on January 9, 2020. The incident potentially exposed personal data, including names, addresses, phone numbers, email addresses, partial or full Social Security numbers, dates of birth, member IDs, benefits enrollment information, health factors, and compensation for approximately 2 New Hampshire residents. OneDigital notified affected individuals by March 27, 2020, and offered one year of identity theft protection. The company installed encryption software on all employee devices as a remediation measure.

Incident timeline

discovery → filing · 13 weeks / 89 days

Jan 9, 2020

Begins

Jan 9, 2020

Discovered

Apr 7, 2020

Filed

vs. sector median

+2 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed2 affectedView incident

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.