AccidentalGovernmentHealthcareGovernmentMisdeliveryCustomer Data InvolvedIdentity (basic)Government IDPIIMediumResolved

Department of Health Care Services

bd_bf41e06fa6884f03 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 12, 2023

Filed

Mar 20, 2023

To disclose

10 weeks

Affected

Not disclosed

Confidence

65%

Full breach record for Department of Health Care Services →

The California Department of Health Care Services (DHCS) notified residents that a subcontractor, Advanced Image Direct, misdirected IRS Form 1095-B mailings containing personal information (name, address, DOB, last 4 of SSN, case number) to unintended recipients. The error was discovered on January 12, 2023, following a breach date of January 9, 2023. DHCS paused operations, investigated, attempted retrieval of mail, and is offering credit monitoring.

J jump to incidentP pin to compareR raw source

California clockDiscovered Jan 12, 2023 → Notified Mar 13, 202360d ✓ CA 60-day OK10 weeks discovery → filing

Incident timeline

undetected · 3 days

discovery → filing · 10 weeks / 67 days

Jan 9, 2023

Begins

Jan 12, 2023

Discovered

Mar 20, 2023

Filed

vs. sector median

1 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: Department of Health Care Services
norm: department of health care
Domain: dhcs.ca.gov

Name: Department of Health Care Services
norm: department of health care
Domain: dhcs.ca.gov
Industry: GovernmentllmHealthcarellm

Discovered: Jan 12, 2023
Breach occurred: Jan 9, 2023
Undetected for: 3 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 13, 2023
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDPII
Data elements: Social Security numberDate of birth
Attack vector: Unknown
Third party: via Advanced Image Direct

During the incident: OSP immediately paused printing and mailing operations
OSP conducted a full investigation of AID
OSP attempted to retrieve the misdirected mailings from unintended recipients
DHCS will mail a replacement Form 1095-B for tax year 2022
Changes made: Implementing more stringent quality control measures
Retraining individuals on how to follow these procedures to prevent similar incidents
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 10 weeks(67 days from discovery to filing)
Compliance flags: CA 60-day OK · 60d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Jan 12, 2023
→ Notified: Mar 13, 2023
60d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Jan 12, 2023 → Notified: Mar 13, 2023	60d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-564534
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 20, 2023
Raw hash: 1bf5565b1b0892940e60319692b8c4bfc441278e96424c9ba0d545a8b8a7d88a

Reporting entityDepartment of Health Care Services

Victim entityDepartment of Health Care Services

Incidentdiscovered Jan 12, 2023

Stated responseOSP immediately paused printing and mailing operations

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov