HackingData ExfiltratedCustomer Data InvolvedPHIIDENTITY_BASICHEALTH_BASICLowContained
EpiSource
bd_e03b6cfce712071e · schema v1 · pii pii-v1
Full breach record for EpiSource →Episource, LLC reported a data breach where a criminal accessed and copied data between January 27 and February 6, 2025. The incident was discovered on February 6, 2025. Affected data includes contact information, health insurance data, and health data (PHI). This is a supplemental notice sent to individuals for whom addresses were previously unavailable. Episource engaged forensic investigators, notified law enforcement, and shut down systems. Two years of credit monitoring are offered.
California clockDiscovered Feb 6, 2025 → Notified Feb 9, 2026368d ✗ CA 60-day late12 months discovery → filing
This filing is one of 3 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (2) · sorted by filing gap
- bd_5f78056b95d71c8eNew Hampshire State AGfiled 2026-02-10(1d gap)Verified
- bd_902d3567da6db005Texas State AGfiled 2026-02-11(2d gap)Verified by operator
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-618409
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Feb 9, 2026
- Raw hash
- e7ba30647c45d7f1e62e713def50f684afb9b420a8c397d8cd4169c454cb850d
Reporting entity
- Name
- EpiSourcenorm: episource
Victim entity
- Name
- EpiSourcenorm: episource
Incident
- Discovered
- Feb 6, 2025
- Materiality determined
- —
- Notification sent
- Feb 9, 2026
- Affected individuals
- Not disclosed
- Data types
- PHIIDENTITY_BASICHEALTH_BASIC
- Attack vector
- Unknown
- MITRE ATT&CK
- T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
- Threat actor
- External
Compliance
- Time to disclose
- 12 months(368 days from discovery to filing)
- Compliance flags
- CA 60-day late · 368dCA AG copy ≤15d · 0d
- Discovery-date grounding
- letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Feb 6, 2025→ Notified: Feb 9, 2026368d 60 days (analyst band, pre-2026 discoveries) CA 60-day late California Consumers notified: Feb 9, 2026→ AG copy submitted: Feb 9, 20260d 15 calendar days CA AG copy ≤15d
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.