HackingHealthcareRetail & ConsumerHealthcareData ExfiltratedEmployee Data InvolvedIdentity (basic)Government IDFinancial accountHealth (basic)EmploymentMediumActive

Medical Depot, Inc.

bd_c5ab5e466b2c428d · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 4, 2020

Filed

Sep 14, 2020

To disclose

15 weeks

Affected

Not disclosed

Linked

2 filings

Confidence

65%

Full breach record for Medical Depot, Inc. →3 incidents on file

Medical Depot, Inc. (d/b/a Drive DeVilbiss Healthcare) disclosed that an unauthorized third party gained remote access to its network on or about June 4, 2020. The actor acquired and briefly possessed an electronic file system containing internal company information, including employee and beneficiary data such as names, SSNs, bank account numbers, tax IDs, and health condition information. The company engaged cybersecurity experts, contacted law enforcement, and offered credit monitoring. The investigation was ongoing at the time of notification.

J jump to incidentP pin to compareR raw source

California clockDiscovered Jun 4, 2020 → Notified Jul 3, 202029d ✓ CA 60-day OK15 weeks discovery → filing

Incident timeline

undetected · 10 days

discovery → filing · 15 weeks / 102 days

May 25, 2020

Begins

Jun 4, 2020

Discovered

Sep 14, 2020

Filed

vs. sector median

+2 wks slower

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Maine State AGbd_8485fc230aeb82562020-09-14Candidate

Name: Medical Depot, Inc.
norm: medical depot
Domain: drivemedical.com

Name: Medical Depot, Inc.
norm: medical depot
Domain: drivemedical.com
Also named: Medical Depot, Inc.dba oflegal entity
Drive DeVilbiss Healthcaredba oftrade name
Industry: HealthcarellmRetail & Consumerllm

Discovered: Jun 4, 2020
Breach occurred: May 25, 2020
Undetected for: 10 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 3, 2020
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDFinancial accountHealth (basic)Employment
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
Threat actor: External

During the incident: Contacted law enforcement
Engaged outside cybersecurity experts to help remediate and ensure the ongoing security of our systems
Offered complimentary two-year membership to Equifax Credit Watch Gold with Web Detect
Changes made: Enhanced cybersecurity protections throughout our environment
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 15 weeks(102 days from discovery to filing)
Compliance flags: CA 60-day OK · 29d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Jun 4, 2020
→ Notified: Jul 3, 2020
29d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Jun 4, 2020 → Notified: Jul 3, 2020	29d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Maine State AGSep 14 · first

California State AGSep 14 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-194044
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 14, 2020
Raw hash: 132163293755310ed0d94cdbce90d736eb48b3394ca97bf0b0fcecf6bea5b189

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityMedical Depot, Inc.

Victim entityMedical Depot, Inc.

Incidentdiscovered Jun 4, 2020

Stated responseContacted law enforcement

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov