HackingData ExfiltratedCustomer Data InvolvedPHIIDENTITY_BASICIDENTITY_GOVERNMENTHEALTH_BASICMediumContained
EpiSource
bd_f15da46434be91a2 · schema v1 · pii pii-v1
Full breach record for EpiSource →Episource, LLC reported a data breach where an unauthorized third party accessed and copied data from January 27 to February 6, 2025. The incident was discovered on February 6, 2025. Affected data includes contact information, health insurance data, health data (diagnoses, treatments), and potentially Social Security numbers. Episource engaged forensic investigators, notified law enforcement, and shut down systems. They are offering two years of credit monitoring.
California clockDiscovered Feb 6, 2025 → Notified Jun 6, 2025120d ✗ CA 60-day late17 weeks discovery → filing
This filing is one of 14 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (10) · sorted by filing gap
- bd_61b844bea6eb84e8Oregon State AGfiled 2025-06-06Candidate
- bd_b89e0c880448cf1bCalifornia State AGfiled 2025-07-11(35d gap)Verified
- bd_00920f0067d5e69dCalifornia State AGfiled 2025-07-31(55d gap)Verified
- bd_95baeb3422bb54e2Montana State AGfiled 2025-07-31(55d gap)Verified
Show 6 more filings ↓Show fewer ↑up to 188d gap
- bd_1b92ab769d91dc2aCalifornia State AGfiled 2025-09-11(97d gap)Verified by operator
- bd_9fdbc50e284e387eCalifornia State AGfiled 2025-09-22(108d gap)Verified by operator
- bd_f7b2fef6a5a68d49California State AGfiled 2025-10-01(117d gap)Verified by operator
- bd_9fbf33f1d80fd6cdCalifornia State AGfiled 2025-10-15(131d gap)Verified by operator
- bd_8bfabd788a54c7ddMontana State AGfiled 2025-11-12(159d gap)Verified by operator
- bd_a777c7526ecf94bdOregon State AGfiled 2025-12-11(188d gap)Verified by operator
Showing first 10 of 13 linked disclosures.
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-603716
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jun 6, 2025
- Raw hash
- a69b7fe6eafd3366a423535b427e444c6dbbd3aa3902329c57e31449104276a7
Reporting entity
- Name
- EpiSourcenorm: episource
Victim entity
- Name
- EpiSourcenorm: episource
Incident
- Discovered
- Feb 6, 2025
- Materiality determined
- —
- Notification sent
- Jun 6, 2025
- Affected individuals
- Not disclosed
- Data types
- PHIIDENTITY_BASICIDENTITY_GOVERNMENTHEALTH_BASIC
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
- Threat actor
- External
Compliance
- Time to disclose
- 17 weeks(120 days from discovery to filing)
- Compliance flags
- CA 60-day late · 120d
- Discovery-date grounding
- letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Feb 6, 2025→ Notified: Jun 6, 2025120d 60 days (analyst band, pre-2026 discoveries) CA 60-day late
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.