Social EngineeringHealthcareHealthcareVishingStolen CredentialsData ExfiltratedCustomer Data InvolvedPHIHealth (basic)Identity (basic)Government IDMediumContained

Quantum Health, Inc.

bd_db3f1eec26c6984d · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 1, 2026

Filed

Aug 14, 2026

To disclose

11 weeks

Affected

Not disclosed

Linked

9 filings

Confidence

65%

Full breach record for Quantum Health, Inc. →

Quantum Health, Inc. experienced a data breach resulting from a vishing attack on May 29, 2026. An unauthorized party accessed and acquired files containing health information, insurance details, and personal data (including potential SSNs) between May 29 and June 1, 2026. The incident was detected on June 1, 2026. Quantum Health secured systems, engaged forensics, notified law enforcement, and is offering identity monitoring to affected individuals.

J jump to incidentP pin to compareR raw source

California clockDiscovered Jun 1, 2026 → Notified Jul 27, 202656d ✗ CA 30-day late11 weeks discovery → filing

Incident timeline

undetected · 3 days

discovery → filing · 11 weeks / 74 days

May 29, 2026

Begins

Jun 1, 2026

Discovered

Aug 14, 2026

Filed

vs. sector median

on median

This filing is one of 9 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (8) · sorted by filing gap

Washington State AGbd_5b6eaf5624db3f052026-08-14Verified
Oregon State AGbd_94e0ec22967674672026-08-14Verified
South Carolina State AGbd_2fccf5512e3736a82026-08-17 · +3dVerified
Texas State AGbd_bcba8d4a1d35228f2026-08-18 · +4dVerified

Show 4 more filings ↓up to 44d gap

Massachusetts State AGbd_73b571b03dc8be542026-07-30 · +15dVerified
HHS OCRbd_057652d229111d6b2026-07-29 · +16dVerified
New Hampshire State AGbd_6fe352feb65bd2de2026-07-29 · +16dVerified
Illinois State AGbd_e021fcb45440ad832026-07-01 · +44dCandidate

Name: Quantum Health, Inc.
norm: quantum health

Name: Quantum Health, Inc.
norm: quantum health
Industry: Healthcarellm

Discovered: Jun 1, 2026
Breach occurred: May 29, 2026 – Jun 1, 2026
Undetected for: 3 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 27, 2026
Affected individuals: Not disclosed
Data types: PHIHealth (basic)Identity (basic)Government ID
Attack vector: Phishing
MITRE ATT&CK: T1566 PhishingT1078 Valid AccountsT1041 Exfiltration Over C2 Channel
Threat actor: External
Regulator citations: Reported the incident to federal law enforcement
Initial access: phishing_link

During the incident: Secured and isolated our systems
Launched an investigation with the support of third-party forensics experts
Reported the incident to federal law enforcement
Offering identity monitoring through Kroll at no cost
Changes made: Enhancing our existing security protocols
Implementing additional security measures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 11 weeks(74 days from discovery to filing)
Compliance flags: CA 30-day late · 56dCA AG copy >15d · 18d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Jun 1, 2026
→ Notified: Jul 27, 2026
56d 30 calendar days CA 30-day late
California
Consumers notified: Jul 27, 2026
→ AG copy submitted: Aug 14, 2026
18d 15 calendar days CA AG copy >15d

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Jun 1, 2026 → Notified: Jul 27, 2026	56d	30 calendar days	CA 30-day late
California	Consumers notified: Jul 27, 2026 → AG copy submitted: Aug 14, 2026	18d	15 calendar days	CA AG copy >15d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 9 filings · 9 states

View merged incident ↗

Illinois State AGJul 1 · first

HHS OCR+28d

New Hampshire State AG+28d

Massachusetts State AG+29d

Washington State AG+44d

Oregon State AG+44d

California State AG+44d · this page

South Carolina State AG+47d

Texas State AG+48d

Pattern: first filing Jul 1 (IL), last Aug 18 (TX) — a 48-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-628342
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 14, 2026
Raw hash: 9be30bdd7aeaa1c86a1dc223deddf00e39e71401917b3ee549160499db4bd13c

Linked disclosures

Regulatory filings (8) · sorted by filing gap

Reporting entityQuantum Health, Inc.

Victim entityQuantum Health, Inc.

Incidentdiscovered Jun 1, 2026

Stated responseSecured and isolated our systems

ComplianceCA 30-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov