PhysicalHealthcareHealthcareTheftEmployee Data InvolvedIdentity (basic)Government IDEmploymentMediumActive

California Dialysis Management Services, Inc.

bd_e3dc4fb6c841d92f · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 3, 2020

Filed

Sep 16, 2020

To disclose

6 weeks

Affected

Not disclosed

Confidence

65%

Full breach record for California Dialysis Management Services, Inc. →

California Dialysis Management Services, Inc. (CDMS) notified the California Attorney General of a security breach involving employee personal information. On August 3, 2020, the FBI notified CDMS that an individual had been arrested in possession of CDMS documents containing employee names, addresses, birth dates, and Social Security numbers. CDMS hired a forensic firm and is cooperating with law enforcement. Affected employees were offered one year of complimentary Experian IdentityWorks Credit 3B identity protection services.

J jump to incidentP pin to compareR raw source

California clockDiscovered Aug 3, 2020 → Notified Sep 8, 202036d ✓ CA 60-day OK6 weeks discovery → filing

Incident timeline

discovery → filing · 6 weeks / 44 days

Aug 3, 2020

Discovered

Sep 16, 2020

Filed

vs. sector median

6 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: California Dialysis Management Services, Inc.
norm: california dialysis management

Name: California Dialysis Management Services, Inc.
norm: california dialysis management
Industry: Healthcarellm

Discovered: Aug 3, 2020
Materiality determined: —
Notification sent: Sep 8, 2020
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDEmployment
Data elements: Date of birth
Attack vector: Unknown
Threat actor: External
Regulator citations: Notified by the FBI on August 3, 2020

During the incident: Cooperating with the law enforcement investigation
Hired a forensic firm to assist with our investigation into the matter
Arranged for a complimentary one-year membership of Experian IdentityWorksSM Credit 3B for all those who were potentially impacted
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(44 days from discovery to filing)
Compliance flags: CA 60-day OK · 36d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Aug 3, 2020
→ Notified: Sep 8, 2020
36d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Aug 3, 2020 → Notified: Sep 8, 2020	36d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-194122
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 16, 2020
Raw hash: bbd0326991bd6a94cbe71fb16c53b493f8453d675c8c9c9840b04dfc7781df86

Reporting entityCalifornia Dialysis Management Services, Inc.

Victim entityCalifornia Dialysis Management Services, Inc.

Incidentdiscovered Aug 3, 2020

Stated responseCooperating with the law enforcement investigation

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov