PhysicalHealthcareEducationHealthcareTheftCustomer Data InvolvedEmployee Data InvolvedPHIHealth (basic)Identity (basic)Government IDMediumResolved

University of California, San Francisco

bd_da2afc3bbb8930de · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 25, 2013

Filed

Nov 21, 2013

To disclose

8 weeks

Affected

Not disclosed

Linked

3 filings

Confidence

64%

Full breach record for University of California, San Francisco →6 incidents on file

University of California San Francisco (UCSF) reported the theft of an unencrypted personal laptop from a physician's vehicle on September 25, 2013. The laptop contained protected health information (PHI), names, and potentially social security numbers, dates of birth, and medical record numbers of patients. UCSF determined the scope of the breach on November 13, 2013, and notified affected individuals on November 21, 2013. The incident involved physical theft of a device containing sensitive health data.

J jump to incidentP pin to compareR raw source

California clockDiscovered Sep 25, 2013 → Notified Nov 21, 201357d ✓ CA 60-day OK8 weeks discovery → filing

Incident timeline

discovery → filing · 8 weeks / 57 days

Sep 25, 2013

Begins

Sep 25, 2013

Discovered

Nov 21, 2013

Filed

vs. sector median

3 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

HHS OCRbd_fbd674aab328bdd32013-11-22 · +1dVerified
HHS OCRbd_18801ef8114147b02013-10-03 · +49dCandidate

Name: University of California, San Francisco
norm: university of california san francisco
Domain: ucsf.edu

Name: University of California, San Francisco
norm: university of california san francisco
Domain: ucsf.edu
Industry: HealthcarellmEducationllm

Discovered: Sep 25, 2013
Breach occurred: Sep 25, 2013
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 21, 2013
Affected individuals: Not disclosed
Data types: PHIHealth (basic)Identity (basic)Government ID
Attack vector: Unknown
MITRE ATT&CK: T1052 Exfiltration Over Physical Medium

During the incident: Began a technical analysis to identify what information was on the laptop
Provided one free year of FraudStop Credit and CyberScan monitoring and recovery services
Changes made: Strengthening educational and operational processes for information security
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(57 days from discovery to filing)
Compliance flags: CA 60-day OK · 57d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Sep 25, 2013
→ Notified: Nov 21, 2013
57d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Sep 25, 2013 → Notified: Nov 21, 2013	57d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings

View merged incident ↗

HHS OCROct 3 · first

California State AG+49d · this page

HHS OCR+50d

Pattern: first filing Oct 3 (CA), last Nov 22 (CA) — a 50-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-43352
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 21, 2013
Raw hash: 5af33ca43f10c2bb4f3652a8d392557a96287beef036637b8d1be36d4c7468af

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityUniversity of California, San Francisco

Victim entityUniversity of California, San Francisco

Incidentdiscovered Sep 25, 2013

Stated responseBegan a technical analysis to identify what information was on the laptop

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov