HackingHealthcareHealthcareStolen CredentialsCustomer Data InvolvedIdentity (basic)Government IDPHIHealth (basic)FinancialMediumContained

Eastern Los Angeles Regional Center

bd_f89c96959611403a · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 15, 2021

Filed

Sep 13, 2021

To disclose

9 weeks

Affected

Not disclosed

Linked

2 filings

Confidence

65%

Full breach record for Eastern Los Angeles Regional Center →2 incidents on file

Eastern Los Angeles Regional Center (ELARC) experienced unauthorized access to one employee email account on July 15, 2021. The incident potentially exposed client information including names, Social Security numbers, tax IDs, and medical history/treatment information. ELARC secured the system, engaged cybersecurity specialists, and offered 12 months of identity monitoring via Kroll.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 9 weeks / 60 days

Jul 15, 2021

Begins

Jul 15, 2021

Discovered

Sep 13, 2021

Filed

vs. sector median

4 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

HHS OCRbd_80fb2dfbb907eb372021-09-13Verified

Name: Eastern Los Angeles Regional Center
norm: eastern los angeles regional center

Name: Eastern Los Angeles Regional Center
norm: eastern los angeles regional center
Industry: Healthcarellm

Discovered: Jul 15, 2021
Breach occurred: Jul 15, 2021
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDPHIHealth (basic)Financial
Data elements: Social Security numberMedical information
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: External
Initial access: valid_credentials

During the incident: Took swift action to secure its email system and network
Launched an internal investigation
Engaged leading, independent cybersecurity specialists
Implemented additional technical safeguards to further enhance the security of information in our possession and prevent similar incidents from happening in the future
Arranged for you to activate, at no cost to you, an online identity monitoring service for 12 months provided by Kroll
Changes made: Implemented additional technical safeguards to further enhance the security of information in our possession and prevent similar incidents from happening in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(60 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings

View merged incident ↗

HHS OCRSep 13 · first

California State AGSep 13 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-545286
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 13, 2021
Raw hash: d87f6803fffb045a02e34cb1f21d69f8e65158621738c91f5a935849891ad888

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityEastern Los Angeles Regional Center

Victim entityEastern Los Angeles Regional Center

Incidentdiscovered Jul 15, 2021

Stated responseTook swift action to secure its email system and network

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov