AccidentalHealthcareHealthcareMisdeliveryCustomer Data InvolvedPHIIdentity (basic)Health (basic)LowResolved

CardioFit Medical Group, Inc.

bd_d322ce828fe1498e · schema v1 · pii pii-v1

Severity

Low

Discovered

Feb 17, 2026

Filed

Apr 9, 2026

To disclose

7 weeks

Affected

Not disclosed

Linked

2 filings

Confidence

65%

Full breach record for CardioFit Medical Group, Inc. →

CardioFit Medical Group, Inc. disclosed that between January 8 and February 5, 2026, protected health information was sent via unencrypted email. The incident was discovered on February 17, 2026. Affected data included names, demographic details, clinical information (diagnosis), and insurance information. No SSNs, bank accounts, or credit cards were involved. The organization strengthened email encryption procedures and provided staff training.

J jump to incidentP pin to compareR raw source

California clockDiscovered Feb 17, 2026 → Notified Apr 10, 202652d ✗ CA 30-day late7 weeks discovery → filing

Incident timeline

undetected · 40 days

discovery → filing · 7 weeks / 51 days

Jan 8, 2026

Begins

Feb 17, 2026

Discovered

Apr 9, 2026

Filed

vs. sector median

5 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

HHS OCRbd_d7c8cc88c2cb68aa2026-04-09Candidate

Name: CardioFit Medical Group, Inc.
norm: cardiofit medical

Name: CardioFit Medical Group, Inc.
norm: cardiofit medical
Industry: Healthcarellm

Discovered: Feb 17, 2026
Breach occurred: Jan 8, 2026 – Feb 5, 2026
Undetected for: 40 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 10, 2026
Affected individuals: Not disclosed
Data types: PHIIdentity (basic)Health (basic)
Attack vector: Unknown

During the incident: Conducted a thorough review
Strengthened our procedures related to email encryption
Provided additional training to our staff
Changes made: Strengthened our procedures related to email encryption
Provided additional training to our staff
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 weeks(51 days from discovery to filing)
Compliance flags: CA 30-day late · 52dCA AG copy ≤15d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Feb 17, 2026
→ Notified: Apr 10, 2026
52d 30 calendar days CA 30-day late
California
Consumers notified: Apr 10, 2026
→ AG copy submitted: Apr 9, 2026
— 15 calendar days CA AG copy ≤15d

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Feb 17, 2026 → Notified: Apr 10, 2026	52d	30 calendar days	CA 30-day late
California	Consumers notified: Apr 10, 2026 → AG copy submitted: Apr 9, 2026	—	15 calendar days	CA AG copy ≤15d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings

View merged incident ↗

HHS OCRApr 9 · first

California State AGApr 9 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-621561
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 9, 2026
Raw hash: 89a5075a29f994b84e57675d7a5121bc111b89c1357952b5c408a02dae9770fc

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityCardioFit Medical Group, Inc.

Victim entityCardioFit Medical Group, Inc.

Incidentdiscovered Feb 17, 2026

Stated responseConducted a thorough review

ComplianceCA 30-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov