AccidentalHealthcareTechnologyHealthcareMisconfigurationCustomer Data InvolvedPHIHealth (basic)LocationMetadataLowContained

Insulet Corporation

bd_c92cd96665cb3150 · schema v1 · pii pii-v1

Severity

Low

Discovered

Dec 6, 2022

Filed

Dec 21, 2022

To disclose

15 days

Affected

Not disclosed

Linked

7 filings

Confidence

64%

Full breach record for Insulet Corporation →8 incidents on file

Insulet Corporation disclosed a data privacy incident affecting Omnipod DASH customers. Between December 1 and December 6, 2022, web pages used for medical device correction (MDC) receipt verification exposed customer IP addresses, Omnipod DASH usage status, and Personal Diabetes Manager (PDM) usage to third-party marketing and performance partners via cookies. No financial data, SSNs, or passwords were exposed. Insulet disabled the tracking codes and requested partners delete logs.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 5 days

discovery → filing · 15 days

Dec 1, 2022

Begins

Dec 6, 2022

Discovered

Dec 21, 2022

Filed

vs. sector median

10 wks faster

This filing is one of 7 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

Illinois State AGbd_4e14c83bbb87dd602023-01-01 · +11dVerified
HHS OCRbd_2cb545435cd825282023-01-05 · +15dVerified
Delaware State AGbd_4b77c0e779b47ea32023-01-05 · +15dVerified
Washington State AGbd_ac854debf0ab0ad92023-01-05 · +15dVerified

Show 2 more filings ↓up to 20d gap

Montana State AGbd_b72b9465f971309e2023-01-09 · +19dVerified
California State AGbd_09375a81f3d038e82023-01-10 · +20dVerified

Name: Insulet Corporation
norm: insulet
Domain: insulet.com

Name: Insulet Corporation
norm: insulet
Domain: insulet.com
Industry: HealthcarellmTechnologyllm

Discovered: Dec 6, 2022
Breach occurred: Dec 1, 2022 – Dec 6, 2022
Undetected for: 5 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 5, 2023
Affected individuals: Not disclosed
Data types: Identity (basic)Authentication
Attack vector: Misconfiguration
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Initial access: exploit_public_facing

During the incident: Disabled all tracking codes on the MDC acknowledgment web page
Requesting that our partners delete logs of the IP addresses and unique URLs
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 15 days(15 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 6 states

View merged incident ↗

Delaware State AGDec 21 · first · this page

Illinois State AG+11d

HHS OCR+15d

Delaware State AG+15d

Washington State AG+15d

Montana State AG+19d

California State AG+20d

Pattern: first filing Dec 21 (DE), last Jan 10 (CA) — a 20-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://attorneygeneral.delaware.gov/wp-content/uploads/sites/50/2023/01/Notice-to-Customers.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 21, 2022
Raw hash: 1128b213abd83c5497e5bea3e6bfb4d4eadf5b1df9558a76fc6fb8cf65776339

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityInsulet Corporation

Victim entityInsulet Corporation

Incidentdiscovered Dec 6, 2022

Stated responseDisabled all tracking codes on the MDC acknowledgment web page

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceattorneygeneral.delaware.gov