HackingHealthcareHealthcareCustomer Data InvolvedIdentity (basic)LowContained

Lincare Holdings Inc.

bd_bc707d9db183cd33 · schema v1 · pii pii-v1

Severity

Low

Discovered

Sep 26, 2021

Filed

Jan 3, 2023

To disclose

15 months

Affected

Not disclosed

Linked

2 filings

Confidence

64%

Full breach record for Lincare Holdings Inc. →11 incidents on file

Lincare Holdings Inc. experienced unauthorized access to certain systems between September 10 and September 29, 2021. The incident was discovered on September 26, 2021. Affected data includes names and other personal information. Lincare engaged outside cybersecurity experts, notified law enforcement, reset passwords, and is offering one year of complimentary credit monitoring through Kroll.

J jump to incidentP pin to compareR raw source

California clockDiscovered Sep 26, 2021 → Notified Sep 2, 2022341d ✗ CA 60-day late15 months discovery → filing

Incident timeline

undetected · 16 days

discovery → filing · 15 months / 464 days

Sep 10, 2021

Begins

Sep 26, 2021

Discovered

Jan 3, 2023

Filed

vs. sector median

+54 wks slower

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Oregon State AGbd_9a9fd72b4bc43cd72023-01-03Candidate

Name: Lincare Holdings Inc.
norm: lincare holdings
Domain: lincare.com

Name: Lincare Holdings Inc.
norm: lincare holdings
Domain: lincare.com
Industry: Healthcarellm

Discovered: Sep 26, 2021
Breach occurred: Sep 10, 2021 – Sep 29, 2021
Undetected for: 16 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 2, 2022
Affected individuals: Not disclosed
Data types: Identity (basic)
Attack vector: Unknown

During the incident: Took immediate action to secure its network
Launched an investigation
Worked with outside cybersecurity experts to determine the source of the activity and potential impact
Notified law enforcement of the incident
Reset all user passwords to block any unauthorized access
Changes made: Implementing additional technological safeguards on systems that contain personal information
Offering complimentary credit monitoring through Kroll for one year
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 15 months(464 days from discovery to filing)
Compliance flags: CA 60-day late · 341dLeak >30d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Sep 26, 2021
→ Notified: Sep 2, 2022
341d 60 days (analyst band, pre-2026 discoveries) CA 60-day late

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Sep 26, 2021 → Notified: Sep 2, 2022	341d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Oregon State AGJan 3 · first

California State AGJan 3 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-561235
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 3, 2023
Raw hash: 0a86af4c943ec57957b8f182b66c804451cfd87489d1ec8aaf3602a0b3268bdb

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityLincare Holdings Inc.

Victim entityLincare Holdings Inc.

Incidentdiscovered Sep 26, 2021

Stated responseTook immediate action to secure its network

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov