AccidentalHealthcareHealthcareMisdeliveryCustomer Data InvolvedPHIHealth (basic)Identity (basic)Financial accountLowContained

Neuro Wellness Spa

bd_f09438527666d542 · schema v1 · pii pii-v2

Severity

Low

Discovered

Sep 16, 2026

Filed

Oct 16, 2026

To disclose

4 weeks

Affected

Not disclosed

Confidence

69%

Full breach record for Neuro Wellness Spa →

Neuro Wellness Spa notified patients that a file containing protected health information was inadvertently emailed to another patient on August 24, 2026. The organization became aware of the incident on September 16, 2026. Affected data included names, dates of service, provider names, and billing information. Social Security numbers and credit card numbers were not involved. The company contacted the unintended recipient to delete the file and enhanced security training.

J jump to incidentP pin to compareR raw source

California clockDiscovered Sep 16, 2026 → Notified Oct 9, 202623d ✓ CA 30-day OK4 weeks discovery → filing

Incident timeline

undetected · 23 days

discovery → filing · 4 weeks / 30 days

Aug 24, 2026

Begins

Sep 16, 2026

Discovered

Oct 16, 2026

Filed

vs. sector median

5 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: Neuro Wellness Spa
norm: neuro wellness

Name: Neuro Wellness Spa
norm: neuro wellness
Industry: Healthcarellm

Discovered: Sep 16, 2026
Breach occurred: Aug 24, 2026
Undetected for: 23 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 9, 2026
Affected individuals: Not disclosed
Data types: PHIHealth (basic)Identity (basic)Financial account
Attack vector: Unknown

During the incident: Initiated an investigation
Contacted the recipient of the file and requested that the information be deleted and not used or shared with others
Confirming deletion of the file
Changes made: Reviewing our security and privacy safeguards
Enhanced our security tools
Enhanced workforce training on the handling of protected health information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 4 weeks(30 days from discovery to filing)
Compliance flags: CA 30-day OK · 23dCA AG copy ≤15d · 7d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Sep 16, 2026
→ Notified: Oct 9, 2026
23d 30 calendar days CA 30-day OK
California
Consumers notified: Oct 9, 2026
→ AG copy submitted: Oct 16, 2026
7d 15 calendar days CA AG copy ≤15d

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Sep 16, 2026 → Notified: Oct 9, 2026	23d	30 calendar days	CA 30-day OK
California	Consumers notified: Oct 9, 2026 → AG copy submitted: Oct 16, 2026	7d	15 calendar days	CA AG copy ≤15d

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-631463
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 16, 2026
Raw hash: b6a3302389d0faded588255ce77fb0510c11655479b6fd0f7c6f83370bd761b9

Reporting entityNeuro Wellness Spa

Victim entityNeuro Wellness Spa

Incidentdiscovered Sep 16, 2026

Stated responseInitiated an investigation

ComplianceCA 30-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov