MisuseHealthcareHealthcarePrivilege AbuseEmployee Data InvolvedCustomer Data InvolvedGovernment IDIdentity (basic)Health (basic)PHIEmploymentMediumContained

White Blossom Care Center

bd_be768862234ee7d2 · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 25, 2017

Filed

Jun 30, 2017

To disclose

5 weeks

Affected

900state residents only

Linked

2 filings

Confidence

66%

Full breach record for White Blossom Care Center →

White Blossom Care Center in San Jose, CA, notified residents and employees of a data breach involving a former employee who improperly accessed data. Approximately 800 residents and 100 employees/applicants were affected. Exposed data included names, SSNs, dates of birth, and for some residents, health insurance and limited medical information. The organization engaged forensic experts, contacted law enforcement, reset credentials, and restricted system access.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 5 weeks / 36 days

May 25, 2017

Discovered

Jun 30, 2017

Filed

vs. sector median

4 wks faster

This filing is one of 2 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

HHS OCRbd_0b9e81a52ce2ea152017-06-30Verified

Name: White Blossom Care Center
norm: white blossom care center
Domain: whiteblossomcarecenter.com

Name: White Blossom Care Center
norm: white blossom care center
Domain: whiteblossomcarecenter.com
Industry: Healthcarellm

Discovered: May 25, 2017
Materiality determined: —
Notification sent: —
Affected individuals: 900state-resident count only
Data types: Government IDIdentity (basic)Health (basic)PHIEmployment
Data elements: Social Security numberDate of birthMedical information
Attack vector: Insider
Threat actor: Internal
Regulator citations: Contacted state and federal law enforcement
Initial access: insider_action

During the incident: Engaged an independent technical security expert to investigate this incident
Contacted state and federal law enforcement
Resetting employee computer user accounts and passwords
Reconfiguring computer systems to further limit employee access to already-restricted sensitive resident data
Offering identity theft protection services through Equifax Credit Watch Gold at no cost
Changes made: Resetting employee computer user accounts and passwords
Reconfiguring computer systems to further limit employee access to already-restricted sensitive resident data
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(36 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings

View merged incident ↗

HHS OCRJun 30 · first

California State AGJun 30 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-100028
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 30, 2017
Raw hash: d07079b42964c3d526343677752cc3811c0039c9ea5eec49080f47994d60b1d9

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityWhite Blossom Care Center

Victim entityWhite Blossom Care Center

Incidentdiscovered May 25, 2017

Stated responseEngaged an independent technical security expert to investigate this incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov