HackingHealthcareTechnologyHealthcareStolen CredentialsCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDFinancial accountHealth (basic)PHIMediumContained

AURIS HEALTH, INC.

bd_e19d38c42139e27c · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 1, 2020

Filed

Jan 27, 2021

To disclose

47 weeks

Affected

Not disclosed

Linked

5 filings

Confidence

65%

Full breach record for AURIS HEALTH, INC. →

Auris Health, Inc. disclosed that an unauthorized actor accessed an employee's email account beginning in March 2020. The incident involved personal information including names, SSNs, tax IDs, passport numbers, health insurance numbers, health information, payment card info, and financial account numbers. Auris terminated access, conducted an investigation, and offered two years of credit monitoring via Equifax.

J jump to incidentP pin to compareR raw source

California clockDiscovered Mar 1, 2020 → Notified Jan 27, 2021332d ✗ CA 60-day late47 weeks discovery → filing

Incident timeline

Mar 15, 2020

Begins

Jan 27, 2021

Filed

vs. sector median

+35 wks slower

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Indiana State AGbd_38fb2b9e7fa9f5b02021-01-27Verified
Massachusetts State AGbd_737d0df43122f2212021-01-27Verified
Oregon State AGbd_e52872cd6b8c957f2021-01-27Verified
New Hampshire State AGbd_e8495fd81420ceaa2021-01-29 · +2dVerified

Name: AURIS HEALTH, INC.
norm: auris health

Name: AURIS HEALTH, INC.
norm: auris health
Industry: HealthcarellmTechnologyllm

Discovered: Mar 1, 2020
Breach occurred: Mar 15, 2020
Materiality determined: —
Notification sent: Jan 27, 2021
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDFinancial accountHealth (basic)PHI
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: External
Regulator citations: Providing notice to applicable regulators
Initial access: valid_credentials

During the incident: Terminated the unauthorized actor’s access to our employee’s email account
Undertook an internal investigation
Providing notice to all potentially impacted individuals and applicable regulators
Engaged Equifax to provide ID Patrol 3B credit and identity fraud monitoring service
Changes made: Implementing additional email login authentication measures
Remediate any identified vulnerabilities
Enhance our security controls
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 47 weeks(332 days from discovery to filing)
Compliance flags: CA 60-day late · 332d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Mar 1, 2020
→ Notified: Jan 27, 2021
332d 60 days (analyst band, pre-2026 discoveries) CA 60-day late

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Mar 1, 2020 → Notified: Jan 27, 2021	332d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Indiana State AGJan 27 · first

Massachusetts State AGJan 27 · first

Oregon State AGJan 27 · first

California State AGJan 27 · first · this page

New Hampshire State AG+2d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-537478
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 27, 2021
Raw hash: 5e1f1a8f73c0d3d31ef228deade5e78cb163d3818345dc463ec75b949e832f2c

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityAURIS HEALTH, INC.

Victim entityAURIS HEALTH, INC.

Incidentdiscovered Mar 1, 2020

Stated responseTerminated the unauthorized actor’s access to our employee’s email account

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov