HackingStolen CredentialsSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedIDENTITY_BASICHEALTH_BASICLowContained
California Medicaid & Health Insurance
bd_f2be34f0ff638c04 · schema v1 · pii pii-v1
Full breach record for California Medicaid & Health Insurance →California Health & Wellness (CHW) notified affected individuals that its vendor, Accellion, was compromised by an unknown malicious party between January 7 and January 25, 2021. The breach exposed personal information including names, addresses, dates of birth, insurance IDs, and health information. CHW activated its incident response plan, engaged Accellion, stopped using the vendor, and provided one year of free identity protection services.
Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-539502
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Mar 25, 2021
- Raw hash
- 40fec7294efc8521e4d2da0655cd613cf25b081d70be3790ea95aeea6ba238c4
Reporting entity
- Name
- California Medicaid & Health Insurancenorm: california medicaid health insurance
- Domain
- cahealthwellness.com
Victim entity
- Name
- California Medicaid & Health Insurancenorm: california medicaid health insurance
- Domain
- cahealthwellness.com
Incident
- Discovered
- Jan 25, 2021
- Materiality determined
- —
- Notification sent
- —
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICHEALTH_BASIC
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1195 Supply Chain Compromise
- Threat actor
- External
- Regulator citations
- Accellion is coordinating its incident response with law enforcement authorities, including the United States Federal Bureau of Investigation (FBI)
- Third party
- via Accellion
- Initial access
- supply_chain
Compliance
- Time to disclose
- 8 weeks(59 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.