Cerebral, Inc
bd_c62c74b5661fad19 · schema v1 · pii pii-v1
Full breach record for Cerebral, Inc →Cerebral, Inc. disclosed that it inadvertently shared protected health information (PHI) and other personal data with third-party tracking platforms (Google, Meta, TikTok) and subcontractors via pixels and similar technologies on its websites and apps. The practice occurred from October 12, 2019, until Cerebral determined the issue on January 3, 2023. Affected data included names, contact info, IP addresses, assessment responses, treatment details, and insurance information. Cerebral disabled the tracking technologies, ceased non-compliant data sharing, and offered 12 months of credit monitoring to affected individuals.
Linked disclosures
Why this link?Regulatory filings (2) · sorted by filing gap
- bd_c20a7d3624294b89Washington State AGfiled 2023-03-03(3d gap)Verified
- bd_5205f315d426cb9dHHS OCRfiled 2023-03-01(5d gap)Candidate
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-563910
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Mar 6, 2023
- Raw hash
- d8369cd408a7db35fbd7b368f49825e520c381711fa5b25ef04ff582acec2a2e
Reporting entity
- Name
- Cerebral, Incnorm: cerebral
Victim entity
- Name
- Cerebral, Incnorm: cerebral
Incident
- Discovered
- Jan 3, 2023
- Materiality determined
- —
- Notification sent
- Mar 1, 2023
- Affected individuals
- Not disclosed
- Data types
- PHIIDENTITY_BASICHEALTH_BASICFINANCIAL_ACCOUNT
- Attack vector
- Misconfiguration
- Third party
- via Google, Meta (Facebook), TikTok
Compliance
- Time to disclose
- 9 weeks(62 days from discovery to filing)
- Compliance flags
- CA 60-day OK · 57d
- Discovery-date grounding
- letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Jan 3, 2023→ Notified: Mar 1, 202357d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.