HackingHealthcareHealthcarePhishingStolen CredentialsData ExfiltratedData PublishedCustomer Data InvolvedDelayed DiscoveryPHIIdentity (basic)Financial accountLowContained

Stockton Cardiology Medical Group

bd_c894ddefa9738b82 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jan 17, 2026

Filed

Mar 20, 2026

To disclose

9 weeks

Affected

Not disclosed

Linked

3 filings

Confidence

65%

Full breach record for Stockton Cardiology Medical Group →

Stockton Cardiology Medical Group notified patients of a data breach on March 9, 2026. On December 15, 2025, suspicious emails were identified. On January 17, 2026, it was discovered that an unauthorized individual accessed and removed files containing PHI and PII. On February 17, 2026, some files were publicly disclosed. The group engaged a security firm, shut down remote access, added MFA, and reset passwords. Credit monitoring is offered.

J jump to incidentP pin to compareR raw source

California clockDiscovered Jan 17, 2026 → Notified Mar 9, 202651d ✗ CA 30-day late9 weeks discovery → filing

Incident timeline

undetected · 33 days

discovery → filing · 9 weeks / 62 days

Dec 15, 2025

Begins

Jan 17, 2026

Discovered

Mar 20, 2026

Filed

vs. sector median

2 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitegenesisbd_b4d948ee8b0c7a7d2026-02-17 · +31dVerified

Regulatory filings (1) · sorted by filing gap

HHS OCRbd_becbed37d28097b02026-03-18 · +2dVerified

Name: Stockton Cardiology Medical Group
norm: stockton cardiology medical
Domain: stocktoncardiology.com

Name: Stockton Cardiology Medical Group
norm: stockton cardiology medical
Domain: stocktoncardiology.com
Industry: Healthcarellm

Discovered: Jan 17, 2026
Breach occurred: Dec 15, 2025
Undetected for: 33 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 9, 2026
Affected individuals: Not disclosed
Data types: PHIIdentity (basic)Financial account
Attack vector: Unknown
MITRE ATT&CK: T1566.002 Spearphishing LinkT1041 Exfiltration Over C2 ChannelT1114 Email Collection
Threat actor: External
Initial access: phishing_link

During the incident: Retaining an independent security firm to assist in the investigation of the breach
Making several improvements to the security configuration of our information systems
Shutting down an older remote access service used by our staff
Adding MFA (multi-factor authentication) to certain internal systems
Resetting all passwords on all of our systems
Reviewing our policies for data retention
Offering affected individuals one (1) year of complimentary credit monitoring services through our partner vendor, Epiq
Changes made: Making several improvements to the security configuration of our information systems
Shutting down an older remote access service used by our staff
Adding MFA (multi-factor authentication) to certain internal systems
Resetting all passwords on all of our systems
Reviewing our policies for data retention, so that fewer “working” files are retained
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(62 days from discovery to filing)
Compliance flags: CA 30-day late · 51dCA AG copy ≤15d · 11d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Jan 17, 2026
→ Notified: Mar 9, 2026
51d 30 calendar days CA 30-day late
California
Consumers notified: Mar 9, 2026
→ AG copy submitted: Mar 20, 2026
11d 15 calendar days CA AG copy ≤15d

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Jan 17, 2026 → Notified: Mar 9, 2026	51d	30 calendar days	CA 30-day late
California	Consumers notified: Mar 9, 2026 → AG copy submitted: Mar 20, 2026	11d	15 calendar days	CA AG copy ≤15d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings

View merged incident ↗

HHS OCRMar 18 · first

California State AG+2d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-620623
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 20, 2026
Raw hash: 3933c918189646bb27aa0e5d97a81909c1c1b5ecd1bd2332ae79ccc95da6d3d4

Linked disclosures

Ransomware claims (1)

Regulatory filings (1) · sorted by filing gap

Reporting entityStockton Cardiology Medical Group

Victim entityStockton Cardiology Medical Group

Incidentdiscovered Jan 17, 2026

Stated responseRetaining an independent security firm to assist in the investigation of the breach

ComplianceCA 30-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov