AccidentalHealthcareHealthcareMisconfigurationCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDHealth (basic)EmploymentMediumResolved

The Painted Turtle

bd_eb7b0a093e782883 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 12, 2015

Filed

Mar 11, 2015

To disclose

8 weeks

Affected

Not disclosed

Linked

3 filings

Confidence

64%

Full breach record for The Painted Turtle →

The Painted Turtle, a non-profit camp for children with life-threatening diseases, experienced a database error in its online application system. Between 2013 and 2014, camper and volunteer information (including names, addresses, medical info, SSNs, and driver's license numbers for volunteers) was potentially viewable by listed medical providers, emergency contacts, or references. The issue was discovered on January 12, 2015. The database was taken offline and code was updated to fix the vulnerability. Notifications were sent on March 6, 2015.

J jump to incidentP pin to compareR raw source

California clockDiscovered Jan 12, 2015 → Notified Mar 6, 201553d ✓ CA 60-day OK8 weeks discovery → filing

Incident timeline

undetected · 741 days

discovery → filing · 8 weeks / 58 days

Jan 1, 2013

Begins

Jan 12, 2015

Discovered

Mar 11, 2015

Filed

vs. sector median

3 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_ba2eeabdd1e1f40d2015-03-10 · +1dVerified
New Hampshire State AGbd_aeccf93dff0595022015-03-05 · +6dVerified

Name: The Painted Turtle
norm: the painted turtle

Name: The Painted Turtle
norm: the painted turtle
Industry: Healthcarellm

Discovered: Jan 12, 2015
Breach occurred: Jan 1, 2013 – Dec 31, 2014
Undetected for: 741 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 6, 2015
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDHealth (basic)Employment
Data elements: Social Security numberMedical information
Attack vector: Unknown

During the incident: Brought the database offline to prevent anyone from being able to access your records
Engaged ID Experts to assist with notification and recovery services
Changes made: Updated our database’s code to prevent the issue from occurring again
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(58 days from discovery to filing)
Compliance flags: CA 60-day OK · 53d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Jan 12, 2015
→ Notified: Mar 6, 2015
53d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Jan 12, 2015 → Notified: Mar 6, 2015	53d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

New Hampshire State AGMar 5 · first

Massachusetts State AG+5d

California State AG+6d · this page

Pattern: first filing Mar 5 (NH), last Mar 11 (CA) — a 6-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-48777
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 11, 2015
Raw hash: 7b0f21e85d2928781399a7ee18b4e7ed3852170093c3165b726468a6c611df4d

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityThe Painted Turtle

Victim entityThe Painted Turtle

Incidentdiscovered Jan 12, 2015

Stated responseBrought the database offline to prevent anyone from being able to access your records

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov