HackingData ExfiltratedCustomer Data InvolvedPIIIDENTITY_BASICPHIHEALTH_BASICLowContained
QualDerm Partners, LLC
bd_dfcd3e61fa057a59 · schema v1 · pii pii-v1
Full breach record for QualDerm Partners, LLC →QualDerm Partners, LLC detected unauthorized activity on its network on December 24, 2025. An investigation determined an unauthorized actor accessed systems between December 23 and 24, 2025, and removed information including names and other data elements. Social Security numbers, driver's license numbers, and financial account information were not impacted. The company contained the activity, engaged a third-party forensics firm, notified law enforcement, and is offering 12 months of credit monitoring to affected individuals.
California clockDiscovered Dec 24, 2025 → Notified Feb 20, 202658d ✓ CA 60-day OK8 weeks discovery → filing
This filing is one of 4 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (3) · sorted by filing gap
- bd_35ef9e291d9da18cHHS OCRfiled 2026-02-22(2d gap)Verified
- bd_e7f7a3f17923e0bdOregon State AGfiled 2026-02-23(3d gap)Verified
- bd_5893ce73a8b779e5Texas State AGfiled 2026-02-24(4d gap)Verified
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-619170
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Feb 20, 2026
- Raw hash
- 4f709dbcfb53eaa38a874b83b38c11b170b18011938836a85e7f47daf8b0363e
Reporting entity
- Name
- QualDerm Partners, LLCnorm: qualderm partners
Victim entity
- Name
- QualDerm Partners, LLCnorm: qualderm partners
Incident
- Discovered
- Dec 24, 2025
- Materiality determined
- —
- Notification sent
- Feb 20, 2026
- Affected individuals
- Not disclosed
- Data types
- PIIIDENTITY_BASICPHIHEALTH_BASIC
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
- Threat actor
- External
- Regulator citations
- Provided notice to federal law enforcement and required regulatory agencies
Compliance
- Time to disclose
- 8 weeks(58 days from discovery to filing)
- Compliance flags
- CA 60-day OK · 58dCA AG copy ≤15d · 0d
- Discovery-date grounding
- letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Dec 24, 2025→ Notified: Feb 20, 202658d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK California Consumers notified: Feb 20, 2026→ AG copy submitted: Feb 20, 20260d 15 calendar days CA AG copy ≤15d
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.