Social EngineeringPhishingCustomer Data InvolvedDelayed DiscoveryIDENTITY_BASICIDENTITY_GOVERNMENTHEALTH_BASICMediumContained
Health Plan of San Joaquin (HPSJ)
bd_eb22886cfd085088 · schema v1 · pii pii-v1
Full breach record for Health Plan of San Joaquin (HPSJ) →Health Plan of San Joaquin (HPSJ) notified California residents of a data breach involving unauthorized access to employee email accounts. The incident occurred between September 26, 2020, and October 12, 2020, following a phishing attack. Affected data included names, SSNs, DOBs, and health information. HPSJ reset passwords, engaged forensic specialists, and offered 12 months of free identity monitoring via Equifax.
California clockDiscovered Oct 12, 2020 → Notified May 18, 2021218d ✗ CA 60-day late31 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
This filing is one of 2 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (1) · sorted by filing gap
- bd_90d3d799540bee88Maine State AGfiled 2021-05-18Candidate
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-541021
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- May 18, 2021
- Raw hash
- 744b0681c1583518c08f9bd0ae7559f0509df4f4a222d05a13bc5220a7988333
Reporting entity
- Name
- Health Plan of San Joaquin (HPSJ)norm: health plan of san joaquin hpsj
Victim entity
- Name
- Health Plan of San Joaquin (HPSJ)norm: health plan of san joaquin hpsj
Incident
- Discovered
- Oct 12, 2020
- Materiality determined
- —
- Notification sent
- May 18, 2021
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENTHEALTH_BASIC
- Attack vector
- Phishing
- MITRE ATT&CK
- T1566.002 Spearphishing Link
- Threat actor
- External
- Initial access
- phishing_link
Compliance
- Time to disclose
- 31 weeks(218 days from discovery to filing)
- Compliance flags
- CA 60-day late · 218d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Oct 12, 2020→ Notified: May 18, 2021218d 60 days (analyst band, pre-2026 discoveries) CA 60-day late
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.