HackingHealthcareHealthcareStolen CredentialsCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)LowContained

ELWYN CALIFORNIA

bd_ee540d71ba500a53 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jun 24, 2020

Filed

Feb 11, 2021

To disclose

33 weeks

Affected

Not disclosed

Linked

4 filings

Confidence

64%

Full breach record for ELWYN CALIFORNIA →2 incidents on file

Elwyn discovered unauthorized access to employee email accounts between October 9, 2019, and July 21, 2020. The intrusion was detected on June 24, 2020. Affected individuals' names and other personal information found in emails may have been accessed. Elwyn engaged forensic specialists, reset passwords, and offered one year of credit monitoring.

J jump to incidentP pin to compareR raw source

California clockDiscovered Jun 24, 2020 → Notified Feb 11, 2021232d ✗ CA 60-day late33 weeks discovery → filing

Incident timeline

undetected · 259 days

discovery → filing · 33 weeks / 232 days

Oct 9, 2019

Begins

Jun 24, 2020

Discovered

Feb 11, 2021

Filed

vs. sector median

+21 wks slower

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Indiana State AGbd_391c208c272e24e12021-02-11Verified
Delaware State AGbd_cc2f42ab3cb4784c2021-02-11Verified
New Hampshire State AGbd_4aa4be339893cd7a2021-02-18 · +7dVerified

Name: ELWYN CALIFORNIA
norm: elwyn california

Name: ELWYN CALIFORNIA
norm: elwyn california
Industry: Healthcarellm

Discovered: Jun 24, 2020
Breach occurred: Oct 9, 2019 – Jul 21, 2020
Undetected for: 259 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 11, 2021
Affected individuals: Not disclosed
Data types: Identity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: External

During the incident: Launched an investigation with the assistance of computer forensics specialists
Reset user passwords associated with the activity
Posted notice of this event on our website beginning on or around August 21, 2020
Offering one year of credit monitoring and identity protection services provided by Experian at no cost
Changes made: Confirm and further strengthen the security of our systems, including our email accounts
Continue to review our security policies and procedures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 33 weeks(232 days from discovery to filing)
Compliance flags: CA 60-day late · 232d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Jun 24, 2020
→ Notified: Feb 11, 2021
232d 60 days (analyst band, pre-2026 discoveries) CA 60-day late

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Jun 24, 2020 → Notified: Feb 11, 2021	232d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Indiana State AGFeb 11 · first

Delaware State AGFeb 11 · first

California State AGFeb 11 · first · this page

New Hampshire State AG+7d

Pattern: first filing Feb 11 (IN), last Feb 18 (NH) — a 7-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-537960
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 11, 2021
Raw hash: 1bf6b786a5260c14c035dacccf9832c8fbc15256a2f7abe4bfa8ba203c9c2d7c

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityELWYN CALIFORNIA

Victim entityELWYN CALIFORNIA

Incidentdiscovered Jun 24, 2020

Stated responseLaunched an investigation with the assistance of computer forensics specialists

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov