AccidentalGovernmentHealthcareGovernmentLossEmployee Data InvolvedCustomer Data InvolvedIdentity (basic)Government IDHealth (basic)HighContained

California Department of Public Health

bd_e8b9f55df6e3f2b8 · schema v1 · pii pii-v1

Severity

High

Discovered

Mar 17, 2013

Filed

May 8, 2013

To disclose

7 weeks

Affected

6,000state residents only

Confidence

67%

Full breach record for California Department of Public Health →4 incidents on file

California Department of Public Health (CDPH) reported that a roll of microfiche containing 2,000 birth records from 1974 was found in an unsecure, non-State owned location. The records affect approximately 6,000 individuals (children or parents born in specific months in 1974 in nine counties). Data exposed includes names, addresses, Social Security numbers, and some medical information. The incident was discovered on March 17, 2013. CDPH is investigating with the California Highway Patrol and implementing additional safeguards.

J jump to incidentP pin to compareR raw source

California clockDiscovered Mar 17, 2013 → Notified May 6, 201350d ✓ CA 60-day OK7 weeks discovery → filing

Incident timeline

discovery → filing · 7 weeks / 52 days

Mar 17, 2013

Discovered

May 8, 2013

Filed

vs. sector median

3 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed6,000 affectedView incident

Name: California Department of Public Health
norm: california department of public health

Name: California Department of Public Health
norm: california department of public health
Industry: GovernmentllmHealthcarellm

Discovered: Mar 17, 2013
Materiality determined: —
Notification sent: May 6, 2013
Affected individuals: 6,000state-resident count only
Data types: Identity (basic)Government IDHealth (basic)
Data elements: Social Security numberMedical information
Attack vector: Unknown

During the incident: CDPH is currently investigating the incident
CDPH continues to collaborate with the California Highway Patrol in this investigation
CDPH has the reel of microfiche that was found
Changes made: CDPH has made technological advances over time and continues to implement additional internal safeguards to protect the birth records as the investigation progresses
CDPH is also conducting a thorough review of information security policies and will put in place any additional policies or practices necessary to help prevent such an incident from happening again
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 weeks(52 days from discovery to filing)
Compliance flags: CA 60-day OK · 50d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Mar 17, 2013
→ Notified: May 6, 2013
50d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Mar 17, 2013 → Notified: May 6, 2013	50d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-41737
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 8, 2013
Raw hash: b70b35cd1d2099cb801f6f4ac816ad762facee9e72feb3c57853399bb0cebbc2

Reporting entityCalifornia Department of Public Health

Victim entityCalifornia Department of Public Health

Incidentdiscovered Mar 17, 2013

Stated responseCDPH is currently investigating the incident

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov