HackingHealthcareHealthcareData ExfiltratedCustomer Data InvolvedPIIIdentity (basic)PHIHealth (basic)LowContained

QUALDERM PARTNERS, LLC

bd_dfcd3e61fa057a59 · schema v1 · pii pii-v1

Severity

Low

Discovered

Dec 24, 2025

Filed

Feb 23, 2026

To disclose

9 weeks

Affected

Not disclosed

Linked

6 filings

Confidence

65%

Full breach record for QUALDERM PARTNERS, LLC →3 incidents on file

QualDerm Partners, LLC detected unauthorized activity on its network on December 24, 2025. An investigation determined an unauthorized actor accessed systems between December 23 and 24, 2025, and removed information including names and other data elements. Social Security numbers, driver's license numbers, and financial account information were not impacted. The company contained the activity, engaged a third-party forensics firm, notified law enforcement, and is offering 12 months of credit monitoring to affected individuals.

J jump to incidentP pin to compareR raw source

California clockDiscovered Dec 24, 2025 → Notified Feb 20, 202658d ✓ CA 60-day OK9 weeks discovery → filing

Incident timeline

undetected · 1 days

discovery → filing · 9 weeks / 61 days

Dec 23, 2025

Begins

Dec 24, 2025

Discovered

Feb 23, 2026

Filed

vs. sector median

2 wks faster

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Washington State AGbd_b36e72f1306fe7962026-02-23Verified
Oregon State AGbd_e7f7a3f17923e0bd2026-02-23Verified
Texas State AGbd_5893ce73a8b779e52026-02-24 · +1dVerified
HHS OCRbd_26d1181f0a5b650c2026-02-22 · +1dVerified

Show 1 more filing ↓up to 1d gap

HHS OCRbd_35ef9e291d9da18c2026-02-22 · +1dVerified

Name: QUALDERM PARTNERS, LLC
norm: qualderm partners

Name: QUALDERM PARTNERS, LLC
norm: qualderm partners
Industry: Healthcarellm

Discovered: Dec 24, 2025
Breach occurred: Dec 23, 2025 – Dec 24, 2025
Undetected for: 1 dayoccurrence → discovery
Materiality determined: —
Notification sent: Feb 20, 2026
Affected individuals: Not disclosed
Data types: PIIIdentity (basic)PHIHealth (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
Threat actor: External
Regulator citations: Provided notice to federal law enforcement and required regulatory agencies

During the incident: Took steps to contain the activity
Launched an investigation with the support of a third-party cybersecurity forensics firm
Took steps to secure this information
Thoroughly review and analyze the data to determine what was present within and the patients to whom it relates
Provided notice to federal law enforcement and required regulatory agencies
Offering access to twelve (12) months of complimentary credit monitoring and identity protection services through Cyberscout
Changes made: Reviewing our existing policies and procedures regarding information security
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(61 days from discovery to filing)
Compliance flags: CA 60-day OK · 58dCA AG copy ≤15d · 3d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Dec 24, 2025
→ Notified: Feb 20, 2026
58d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK
California
Consumers notified: Feb 20, 2026
→ AG copy submitted: Feb 23, 2026
3d 15 calendar days CA AG copy ≤15d

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Dec 24, 2025 → Notified: Feb 20, 2026	58d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK
California	Consumers notified: Feb 20, 2026 → AG copy submitted: Feb 23, 2026	3d	15 calendar days	CA AG copy ≤15d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 5 states

View merged incident ↗

HHS OCRFeb 22 · first

Washington State AG+1d

Oregon State AG+1d

California State AG+1d · this page

Texas State AG+2d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-619170
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 23, 2026
Raw hash: 4f709dbcfb53eaa38a874b83b38c11b170b18011938836a85e7f47daf8b0363e

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityQUALDERM PARTNERS, LLC

Victim entityQUALDERM PARTNERS, LLC

Incidentdiscovered Dec 24, 2025

Stated responseTook steps to contain the activity

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov