AccidentalMisconfigurationCustomer Data InvolvedPHIHEALTH_BASICIDENTITY_BASICLowResolved
Wellfleet Group, LLC
bd_e802c5df9583d5f0 · schema v1 · pii pii-v1
Full breach record for Wellfleet Group, LLC →Wellfleet Group, LLC experienced a data security incident due to a website misconfiguration that allowed medical referral pages to be indexed by search engines without authentication. This exposed protected health information (PHI) including names, addresses, dates of birth, and diagnosis codes for students. The issue was discovered on August 1, 2024, and immediately contained by disabling the misconfiguration and removing indexed pages. No malicious cyber activity was involved. Affected individuals were offered 24 months of credit monitoring.
California clockDiscovered Aug 1, 2024 → Notified Oct 11, 202471d ✗ CA 60-day late10 weeks discovery → filing
This filing is one of 5 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (4) · sorted by filing gap
- bd_702c49853db45dd8Vermont State AGfiled 2024-10-11Verified
- bd_b3b97e27a29f8c61Montana State AGfiled 2024-10-11Verified
- bd_79666de62511cf32HHS OCRfiled 2024-10-08(3d gap)Verified
- bd_13dbd31fe1337adeCalifornia State AGfiled 2024-11-11(31d gap)Verified
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-593295
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Oct 11, 2024
- Raw hash
- 3b4e17f486977c11faeb7aff6a69ea0d59b038b236150b1d8dbab0a33d149840
Reporting entity
- Name
- Wellfleet Group, LLCnorm: wellfleet group
Victim entity
- Name
- Wellfleet Group, LLCnorm: wellfleet group
Incident
- Discovered
- Aug 1, 2024
- Materiality determined
- —
- Notification sent
- Oct 11, 2024
- Affected individuals
- Not disclosed
- Data types
- PHIHEALTH_BASICIDENTITY_BASIC
- Attack vector
- Misconfiguration
Compliance
- Time to disclose
- 10 weeks(71 days from discovery to filing)
- Compliance flags
- CA 60-day late · 71d
- Discovery-date grounding
- letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Aug 1, 2024→ Notified: Oct 11, 202471d 60 days (analyst band, pre-2026 discoveries) CA 60-day late
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.