DisclosureLens
Social EngineeringHealthcareFinancial ServicesHealthcarePhishingCustomer Data InvolvedPHIHealth (basic)Identity (basic)LowContained

Health Plan of San Mateo

bd_de9fe860bf4d3e2c · schema v1 · pii pii-v1

Severity

Low

Discovered

Jan 17, 2023

Filed

Mar 17, 2023

To disclose

8 weeks

Affected

Not disclosed

Linked

2 filings

Confidence

66%
Full breach record for Health Plan of San Mateo3 incidents on file

Health Plan of San Mateo disclosed an email phishing incident on January 17, 2023, where an unauthorized person accessed one employee email account. The attacker attempted to fraudulently change direct deposit information. A spreadsheet containing member names, dates of birth, member IDs, and limited nurse advice line call information was potentially exposed. No SSNs or financial data were involved. The company engaged a cybersecurity firm, reviewed the mailbox, enhanced security measures, and provided employee training.

Incident timeline

discovery → filing · 8 weeks / 59 days

Jan 17, 2023

Begins

Jan 17, 2023

Discovered

Mar 17, 2023

Filed

vs. sector median

4 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Filing propagation · 2 filings

View merged incident ↗
HHS OCRMar 17 · first
California State AGMar 17 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.